Plan and apply separation in pipelines in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Why separate Terraform plan and apply stages in CI/CD pipelines?

Consider a CI/CD pipeline that runs Terraform to manage infrastructure. Why is it important to separate the plan and apply stages into different pipeline steps?

A To avoid storing the Terraform state file between stages

B Because Terraform cannot run plan and apply in the same pipeline

C To speed up the pipeline by running both stages in parallel

D To allow manual review and approval of planned changes before applying them

💡 Hint

Think about safety and control when changing infrastructure.

Separating plan and apply allows teams to review the proposed changes before they are made, reducing the risk of unintended modifications.

❓ Configuration

intermediate

Which Terraform CLI command outputs a plan file for later apply?

In a pipeline, you want to generate a plan file that can be applied later. Which Terraform command correctly creates this plan file?

A terraform plan --save=tfplan.binary

B terraform apply -out=tfplan.binary

C terraform plan -out=tfplan.binary

D terraform apply --plan=tfplan.binary

💡 Hint

Look for the command that generates a plan file without applying.

The terraform plan -out=filename command saves the plan to a file for later use with terraform apply.

❓ service_behavior

advanced

What happens if you run 'terraform apply' without a saved plan file in a pipeline?

In a pipeline where plan and apply are separated, what is the behavior if the apply stage runs terraform apply without specifying a saved plan file?

A Terraform will prompt for manual confirmation before applying

B Terraform will create a new plan and apply it immediately without review

C Terraform will apply the last saved plan automatically

D Terraform will fail with an error because no plan file is provided

💡 Hint

Consider what happens when no plan file is given.

Without a saved plan file, terraform apply creates a new plan and applies it immediately, bypassing any prior review.

❓ security

advanced

How to securely share Terraform plan files between pipeline stages?

You want to share the Terraform plan file generated in the plan stage with the apply stage in a CI/CD pipeline. What is the best practice to securely handle this file?

A Store the plan file as a pipeline artifact with restricted access and use encryption if supported

B Commit the plan file to the source code repository for easy access

C Send the plan file via email to the apply stage executor

D Generate the plan file again in the apply stage to avoid sharing

💡 Hint

Think about secure file transfer and access control in pipelines.

Storing the plan file as a pipeline artifact with restricted access and encryption ensures it is securely shared only between pipeline stages.

✅ Best Practice

expert

What is the recommended approach to handle Terraform state in separated plan and apply pipeline stages?

In a pipeline with separated plan and apply stages, how should Terraform state be managed to ensure consistency and avoid conflicts?

A Use a remote backend (e.g., S3, Terraform Cloud) to store state accessible by both stages

B Store the state file locally in the pipeline workspace and pass it between stages

C Generate a new state file in each stage to isolate changes

D Do not use state files; rely on manual tracking of infrastructure

💡 Hint

Think about shared access and locking for state files.

Using a remote backend ensures both plan and apply stages access the same state, preventing conflicts and enabling locking.