Maintaining Infrastructure — Terraform Associate 004 practice questions

A `moved` block with from = aws_instance.old and to = aws_instance.new has what effect?

1. Destroys aws_instance.old and creates aws_instance.new during the next apply.
2. Refreshes the state entry so the new address picks up the current attributes.
3. Imports a second, separate resource into state under the new address name.
4. Renames the state address to aws_instance.new, leaving the real resource alone.

Answer: D — Renames the state address to aws_instance.new, leaving the real resource alone.

D is right: the moved block records a refactor, so Terraform updates the address in state and the plan shows a move rather than a replacement. A is exactly what happens if you rename the resource without the block, which is why it tempts. B confuses the operation with a refresh. C would create a duplicate entry. Because it lives in configuration, a moved block is reviewable and runs for everyone, unlike a one-off CLI invocation.

Which command lists every resource address currently tracked in state?

1. terraform list
2. terraform show -addresses
3. terraform state list
4. terraform refresh -list

Answer: C — terraform state list

Trick: 'state list' is the subcommand. There is no top-level 'terraform list'. Useful for scripting targeted operations.

What does 'terraform import' do?

1. Downloads a child module from its source address into the .terraform/modules directory
2. Downloads and installs the provider plugins named in the required_providers block
3. Loads variable values from a .tfvars file so they can be referenced later as var.NAME
4. Brings an existing resource created outside Terraform under management, recorded in state
5. Converts a JSON document into HCL resource blocks that can be added to the configuration

Answer: D — Brings an existing resource created outside Terraform under management, recorded in state

D is right: import associates an existing object with a configuration address so Terraform starts managing it; you still write the matching resource block. The config-driven import block is the modern form, since it shows up in plan and can generate configuration. A and B are init behaviours, C is variable loading and E is not what import does.

To replace a single resource on the next apply (modern replacement for the deprecated 'taint'):

1. terraform taint <ADDRESS>
2. terraform apply -replace=<ADDRESS>
3. terraform state replace <ADDRESS>
4. terraform destroy -target=<ADDRESS>

Answer: B — terraform apply -replace=<ADDRESS>

Trick: 'taint' is deprecated. The modern flag is 'terraform apply -replace=ADDR' (or 'terraform plan -replace='). 'destroy -target' actually destroys without recreating.

A team wants existing infrastructure brought under management through a reviewable pull request, with the plan showing what will be imported. The BEST approach is:

1. Recreate the objects and let Terraform adopt them automatically
2. Run terraform import for each resource address
3. Run terraform state push with a hand-edited state file
4. Add an import block naming the resource address and object ID

Answer: D — Add an import block naming the resource address and object ID

A) Terraform never adopts unmanaged objects on its own. B) The CLI command mutates state immediately with no plan preview and no artefact in the repository. C) Hand-editing and pushing state is error-prone and bypasses review entirely. D) Correct — the config-driven import block lives in version control, appears in the plan, and is applied as part of the normal workflow, making it reviewable.

TF_LOG environment variable?

Sets verbosity. TRACE, DEBUG, INFO, WARN, ERROR. TRACE most verbose.

How do you force a resource to be recreated?

terraform apply -replace=ADDRESS destroys and recreates that one resource in a normal plan and apply. terraform taint is deprecated and should no longer be taught as the answer.

What do the moved and removed blocks do, and which older commands do they replace?

A moved block records that a resource's address changed — renamed, or pulled into a module — so Terraform updates state instead of destroying and recreating; it replaces terraform state mv. A removed block tells Terraform to drop a resource from state while leaving the real object alive, with a lifecycle { destroy = false } argument; it replaces terraform state rm. Both live in configuration, so the change is reviewable and repeatable.

Resource exists but Terraform thinks it doesn't?

terraform import to bring into state.