Domain 3 of 8

Core Terraform workflow

Domain · 19% of the TA-004 exam

Sort every command by one question: does it change real infrastructure?

The whole domain hangs on one question you can ask of any command: does it change real infrastructure? Only terraform apply does, and terraform destroy is that same command running in reverse (it is an alias for terraform apply -destroy). Everything else prepares, checks, previews, or tidies and provisions nothing: terraform init installs providers and modules, terraform validate type-checks the configuration offline, terraform plan previews the change actions read-only, and terraform fmt rewrites your local files to a canonical style. The loop these commands serve is short and repeatable, the core Terraform workflow: Write (author your infrastructure as code, or IaC), Plan (preview it), then Apply (build it). Keeping the 'who touches infrastructure' line straight defuses a whole class of exam traps that assume a command does more than it does, such as expecting validate to reach a provider API or a plan to create a resource on its own.

The domain unfolds along the life of a single change

Read the subtopics in order and they trace one change from idea to teardown. Describe the Terraform workflow sets the frame: the Write, Plan, Apply loop, the CLI command grammar of the terraform binary followed by global options, a subcommand, and its arguments, and why configuration written in HashiCorp Configuration Language (HCL) belongs in a version control system (VCS). Initialize a working directory covers the prerequisite terraform init that installs providers and child modules and prepares the backend before any other command can run. Validate a configuration runs terraform validate, a static, offline type-check safe to wire into an editor or a continuous integration (CI) pipeline. Generate and review an execution plan is terraform plan, the read-only preview you read by its action symbols and its summary line. Apply changes to infrastructure is terraform apply, the one step that provisions, gated by an approval prompt you answer with yes. Destroy managed infrastructure is terraform destroy, that same apply running in reverse to tear everything down. Apply formatting and style adjustments is terraform fmt, which rewrites your files to one fixed canonical style.

When two answers both work, prefer the one that changes least and shows the change first

Terraform is built to push every real change through a plan you can read and approve, so when an exam question offers two options that both technically work, the intended answer is usually the safer, preview-first, least-destructive one. Plan before you apply, and look before you destroy, since terraform plan -destroy previews a teardown without deleting anything. Prefer the reviewable, in-band path over the out-of-band shortcut: this is why -replace is the supported way to force a resource to be recreated rather than the deprecated terraform taint, and why terraform fmt -check gates formatting in CI instead of silently rewriting files. The approval prompt follows the same instinct: apply stops for a yes because a change to real infrastructure should never be a surprise.

Which core-workflow command touches infrastructure, and where each is covered

Stage or commandWhat it doesChanges real infrastructure?Covered in
The core loopThe Write, Plan, Apply model, CLI grammar, and version controlOnly its Apply stepDescribe the Terraform workflow
terraform initInstalls providers and modules, prepares the backendNoInitialize a working directory
terraform validateStatic, offline check of syntax and typesNoValidate a configuration
terraform planPreviews the change actions, read-onlyNoGenerate and review an execution plan
terraform applyCarries out the plan to reach the desired stateYesApply changes to infrastructure
terraform destroyRemoves all managed objects (apply -destroy)YesDestroy managed infrastructure
terraform fmtRewrites config files to canonical styleNo (local files only)Apply formatting and style adjustments

Subtopics in this domain