Task 3.3: Apply changes to infrastructure

• AAdd -input=true to keep the approval prompt available while printing JSON

  Incorrect

  -json implies -input=false, so no prompt can be shown; the run needs approval some other way.

• BAdd -auto-approve, or apply a saved plan file that a reviewer approved earlier

  Correct

  To use -json with apply, you must also enable -auto-approve or pass a previously saved plan, which counts as approval.

• CAdd -compact-warnings; JSON output fails whenever the plan contains warnings of any kind

  Incorrect

  -compact-warnings only shortens warning text; it has nothing to do with approval.

• DReplace -json with -no-color, the machine-readable mode for plan and apply

  Incorrect

  -no-color only removes terminal formatting; -json is the machine-readable mode.

Because -json disables prompts, apply needs another source of approval: -auto-approve, or better, a saved plan that was reviewed before the apply job ran.

• ADestroy-time provisioners need on_failure = continue, or Terraform skips them during replacement

  Incorrect

  Nothing in the provisioner's own settings is missing; the documented cause is the lifecycle setting added last week.

• BEnabling create_before_destroy on the resource prevents its destroy-time provisioners from running

  Correct

  HashiCorp documents that setting create_before_destroy prevents destroy-time provisioners from running, so the deregistration never happens.

• CDestroy-time provisioners run only for terraform destroy, never when create_before_destroy replaces a resource

  Incorrect

  They run before the resource is destroyed, which includes the destroy half of a replacement, unless something prevents them.

• DThe provisioner refers to self, which is unknown during destroy and makes Terraform skip it

  Incorrect

  self is how a provisioner refers to its parent resource and is valid in destroy-time provisioners.

Destroy-time provisioners are skipped when create_before_destroy is set and when the resource is tainted. Deregistration that must always run belongs in a tool outside the resource lifecycle, such as the service's own health checks.

• AWrap ${var.branch_name} in quotes inside the command string

  Incorrect

  The value is still interpolated into a shell command; the reference recommends environment variable substitution instead.

• BPass the value through the environment argument and read it as an environment variable in the command

  Correct

  Terraform runs the command in a local shell, and the reference recommends the environment parameter over Terraform variables in the command.

• CSet quiet = true so that Terraform does not print the command

  Incorrect

  quiet only suppresses printing the command; it changes nothing about what runs.

• DMove the command into a remote-exec provisioner on the instance

  Incorrect

  remote-exec runs on the remote machine, and Terraform does not sanitize its interpolated inputs either.

Terraform does not sanitize the code in local-exec or remote-exec provisioners or the values interpolated into it. HashiCorp recommends configuration management tools over provisioners where possible.

• ATF_STATE_PERSIST_INTERVAL, set in seconds

  Correct

  It sets the interval for persisting state during apply; the default minimum is 20 seconds, and a lower value falls back to the backend default.

• B-lock-timeout=10m on terraform apply

  Incorrect

  That sets how long to retry acquiring the state lock.

• CTF_REGISTRY_CLIENT_TIMEOUT set to 60

  Incorrect

  Registry requests play no part in saving state during an apply.

• D-refresh=false on each terraform apply

  Incorrect

  That skips refreshing before planning; it does not control saves.

Intermediate saves limit lost work if an apply is interrupted, so raise the interval only when frequent writes cause problems.

• AHCP Terraform rolls back every change the apply has made so far

  Incorrect

  Terraform does not roll back partially completed applies.

• BThe apply stops at once, leaving the state locked

  Incorrect

  Ctrl-C does not stop an apply that has already started remotely.

• CThe state is copied back to the local directory

  Incorrect

  Remote runs keep state in the workspace.

• DLog streaming stops, and the apply keeps running remotely

  Correct

  Ctrl-C cancels a remote apply only while it is still pending; once it has started it only stops streaming the logs.

Follow or cancel a started remote run from the run page in the HCP Terraform UI.

• ATerraform destroys the resource and skips the provisioner

  Incorrect

  Destroy provisioners run before the resource is destroyed, and a failure stops that destruction.

• BThe provisioner never runs again for that resource

  Incorrect

  Terraform reruns failed destroy provisioners.

• CIt errors and reruns the provisioner on the next apply

  Correct

  A failed destroy-time provisioner returns an error, and Terraform reruns the provisioners on the next terraform apply.

• DTerraform marks the provisioner as tainted for manual cleanup

  Incorrect

  Tainting applies to resources, not to provisioners.

Make destroy-time provisioners safe to run multiple times, as a retry can repeat steps that already succeeded.