Plan output reading in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Interpreting Terraform plan output for resource changes

Given the following Terraform plan output snippet, how many resources will be created?

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami           = "ami-123456"
      + instance_type = "t2.micro"
    }

  # aws_s3_bucket.data_bucket will be updated in-place
  ~ resource "aws_s3_bucket" "data_bucket" {
      ~ versioning {
          ~ enabled = false -> true
        }
    }

Plan: 1 to add, 1 to change, 0 to destroy.

A 0

B 3

C 2

D 1

💡 Hint

Look for the '+' sign which indicates resource creation.

The plan shows one resource with a '+' sign meaning it will be created. The other resource has a '~' meaning it will be updated in place.

🧠 Conceptual

intermediate

Understanding Terraform plan output symbols

In Terraform plan output, what does the symbol '~' before a resource name indicate?

A The resource will be updated in-place

B The resource will be created

C The resource will be destroyed

D The resource will be replaced

💡 Hint

Think about what happens when a resource changes but is not destroyed.

The '~' symbol means the resource will be updated in-place without destruction.

❓ Configuration

advanced

Reading Terraform plan output for resource replacement

Review this Terraform plan output snippet. How many resources will be replaced?

  # aws_lb.web_lb must be replaced
-/+ resource "aws_lb" "web_lb" {
      id             = "lb-1234"
      name           = "web-lb"
      internal       = false
      load_balancer_type = "application"
    }

Plan: 1 to add, 0 to change, 1 to destroy.

A 1

B 3

C 2

D 0

💡 Hint

Look for the '-/+' symbol which indicates replacement.

The '-/+' symbol means the resource will be destroyed and recreated, which is a replacement.

❓ security

advanced

Detecting security risks from Terraform plan output

Given this Terraform plan output snippet, which change could introduce a security risk?

  # aws_security_group.sg will be updated in-place
  ~ resource "aws_security_group" "sg" {
      ~ ingress {
          ~ cidr_blocks = ["0.0.0.0/0"] -> ["0.0.0.0/0", "192.168.1.0/24"]
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

A Adding 192.168.1.0/24 to ingress rules reduces exposure

B Adding 0.0.0.0/0 to ingress rules increases exposure

C Adding 192.168.1.0/24 to ingress rules increases exposure

D Removing 0.0.0.0/0 from ingress rules increases exposure

💡 Hint

Consider which IP ranges are more open and risky.

Adding a new CIDR block 192.168.1.0/24 opens access to that subnet, increasing exposure.

❓ Architecture

expert

Analyzing Terraform plan output for multi-resource orchestration

Examine this Terraform plan summary:

Plan: 3 to add, 2 to change, 1 to destroy.

Which of the following statements is true about the infrastructure state after applying this plan?

A The infrastructure will have 2 fewer resources than before

B The infrastructure will have 2 more resources than before

C The infrastructure will have the same number of resources as before

D The infrastructure will have 1 more resource than before

💡 Hint

Calculate net resource count: additions minus destructions.

3 resources added minus 1 destroyed equals a net increase of 2 resources, but 2 resources are changed (updated in place) which does not affect count. So net change is +3 - 1 = +2 resources. Therefore, the infrastructure will have 2 more resources than before.