Plan and apply separation in pipelines in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Why separate Terraform plan and apply stages in CI/CD pipelines?

Consider a CI/CD pipeline that runs Terraform to manage infrastructure. Why is it important to separate the plan and apply stages into different pipeline steps?

A To avoid storing the Terraform state file between stages

B Because Terraform cannot run plan and apply in the same pipeline

C To speed up the pipeline by running both stages in parallel

D To allow manual review and approval of planned changes before applying them

💡 Hint

Think about safety and control when changing infrastructure.

Separating plan and apply allows teams to review the proposed changes before they are made, reducing the risk of unintended modifications.

❓ Configuration

intermediate

Which Terraform CLI command outputs a plan file for later apply?

In a pipeline, you want to generate a plan file that can be applied later. Which Terraform command correctly creates this plan file?

A terraform plan --save=tfplan.binary

B terraform apply -out=tfplan.binary

C terraform plan -out=tfplan.binary

D terraform apply --plan=tfplan.binary

💡 Hint

Look for the command that generates a plan file without applying.

The terraform plan -out=filename command saves the plan to a file for later use with terraform apply.

❓ service_behavior

advanced

What happens if you run 'terraform apply' without a saved plan file in a pipeline?

In a pipeline where plan and apply are separated, what is the behavior if the apply stage runs terraform apply without specifying a saved plan file?

A Terraform will prompt for manual confirmation before applying

B Terraform will create a new plan and apply it immediately without review

C Terraform will apply the last saved plan automatically

D Terraform will fail with an error because no plan file is provided

💡 Hint

Consider what happens when no plan file is given.

Without a saved plan file, terraform apply creates a new plan and applies it immediately, bypassing any prior review.

❓ security

advanced

How to securely share Terraform plan files between pipeline stages?

You want to share the Terraform plan file generated in the plan stage with the apply stage in a CI/CD pipeline. What is the best practice to securely handle this file?

A Store the plan file as a pipeline artifact with restricted access and use encryption if supported

B Commit the plan file to the source code repository for easy access

C Send the plan file via email to the apply stage executor

D Generate the plan file again in the apply stage to avoid sharing

💡 Hint

Think about secure file transfer and access control in pipelines.

Storing the plan file as a pipeline artifact with restricted access and encryption ensures it is securely shared only between pipeline stages.

✅ Best Practice

expert

What is the recommended approach to handle Terraform state in separated plan and apply pipeline stages?

In a pipeline with separated plan and apply stages, how should Terraform state be managed to ensure consistency and avoid conflicts?

A Use a remote backend (e.g., S3, Terraform Cloud) to store state accessible by both stages

B Store the state file locally in the pipeline workspace and pass it between stages

C Generate a new state file in each stage to isolate changes

D Do not use state files; rely on manual tracking of infrastructure

💡 Hint

Think about shared access and locking for state files.

Using a remote backend ensures both plan and apply stages access the same state, preventing conflicts and enabling locking.

Practice

1. What is the main benefit of separating terraform plan and terraform apply in pipelines?

easy

A. It speeds up the deployment by combining steps

B. It skips the need for state files

C. It automatically fixes errors during apply

D. It allows you to review changes before applying them

Solution

1. Step 1: Understand the purpose of terraform plan

   This command shows what changes Terraform will make without applying them.

2. Step 2: Understand the purpose of terraform apply

   This command applies the changes to the infrastructure based on the plan.

3. Final Answer:

   It allows you to review changes before applying them -> Option D

4. Quick Check:

   Plan shows changes first = B [OK]

Hint: Plan shows changes, apply makes them live [OK]

Common Mistakes:

• Thinking plan applies changes
• Believing apply skips state files
• Assuming steps run faster combined

2. Which command correctly saves a Terraform plan to a file named myplan.tfplan?

easy

A. terraform apply -out=myplan.tfplan

B. terraform save myplan.tfplan

C. terraform plan -out=myplan.tfplan

D. terraform plan save myplan.tfplan

Solution

1. Step 1: Identify the correct syntax for saving a plan

   The correct command uses terraform plan -out=filename to save the plan.

2. Step 2: Check each option

   terraform plan -out=myplan.tfplan matches the correct syntax exactly.

3. Final Answer:

   terraform plan -out=myplan.tfplan -> Option C

4. Quick Check:

   Plan with -out saves file = C [OK]

Hint: Use 'plan -out=' to save plans, not apply [OK]

Common Mistakes:

• Using apply instead of plan to save
• Using incorrect command like 'save'
• Missing the '-out=' flag

3. Given these commands run in order:
terraform plan -out=planfile
terraform apply planfile
What happens when you run terraform apply planfile?

medium

A. Terraform applies exactly the changes saved in planfile

B. Terraform ignores planfile and creates a new plan

C. Terraform applies changes but may differ from planfile

D. Terraform throws an error because planfile is not a valid command

Solution

1. Step 1: Understand the role of the saved plan file

   The plan file contains the exact changes Terraform will apply.

2. Step 2: Understand how terraform apply planfile works

   This command applies the saved plan exactly, without recalculating changes.

3. Final Answer:

   Terraform applies exactly the changes saved in planfile -> Option A

4. Quick Check:

   Apply saved plan = exact changes [OK]

Hint: Apply with plan file applies exact saved changes [OK]

Common Mistakes:

• Thinking apply recalculates plan
• Assuming apply ignores plan file
• Believing apply with plan file causes errors

4. You run terraform apply myplan.tfplan but get an error saying the plan file is invalid. What is the most likely cause?

medium

A. You forgot to run terraform init before apply

B. The plan file was created with a different Terraform version

C. You used terraform plan without -out flag

D. The plan file is empty because no changes were detected

Solution

1. Step 1: Identify compatibility issues with plan files

   Plan files are version-specific and may be invalid if Terraform versions differ.

2. Step 2: Check other options

   Running init is required but usually causes different errors; missing -out means no plan file saved; empty plan files do not cause invalid file errors.

3. Final Answer:

   The plan file was created with a different Terraform version -> Option B

4. Quick Check:

   Version mismatch causes invalid plan file error [OK]

Hint: Check Terraform versions match when using saved plans [OK]

Common Mistakes:

• Assuming missing init causes invalid plan file error
• Thinking empty plan files cause invalid file errors
• Confusing missing -out with invalid plan file

5. You want to implement a pipeline that separates planning and applying Terraform changes. Which sequence of commands ensures you can review the plan before applying exactly those changes?

hard

A. terraform plan -out=planfile && terraform apply planfile

B. terraform apply && terraform plan -out=planfile

C. terraform plan && terraform apply

D. terraform apply -out=planfile && terraform apply planfile

Solution

1. Step 1: Identify correct order for plan and apply separation

   First, run terraform plan -out=planfile to save the plan and review it.

2. Step 2: Apply the saved plan exactly

   Then, run terraform apply planfile to apply the reviewed changes exactly.

3. Final Answer:

   terraform plan -out=planfile && terraform apply planfile -> Option A

4. Quick Check:

   Plan with -out then apply saved plan = A [OK]

Hint: Plan with -out then apply saved plan file [OK]

Common Mistakes:

• Applying before planning
• Not saving plan with -out
• Using apply -out which is invalid