Use Terraform outside the core workflow →hardMultiple ChoiceObjective-mapped

TF-004 Use Terraform outside the core workflow Practice Question

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

⚠ Common exam trap

HashiCorp often tests the misconception that simply using a remote backend or running terraform apply in a pipeline is sufficient for governance, but the key requirement here is enforced code review and automated testing, which only Terraform Cloud's policy checks and run triggers provide natively.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Terraform Cloud with run triggers and policy checks

Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Store state in a remote backend and use terraform apply in the pipeline
Why it's wrong here
Storing state in a remote backend centralizes state management, preventing concurrent modification issues and providing a single source of truth. However, simply using `terraform apply` within a CI/CD pipeline, even with remote state, does not inherently enforce code review or policy checks before execution. The pipeline would execute changes automatically based on the merged code, lacking a mandatory human or automated policy gate for review.
✓
Configure Terraform Cloud with run triggers and policy checks
Why this is correct
Terraform Cloud provides a robust platform for managing Terraform workflows, offering features like run triggers that automate infrastructure changes upon code commits. Its integrated policy checks, powered by Sentinel, enforce compliance and security standards by evaluating plans before application. This setup ensures mandatory code review and automated policy enforcement, creating a secure and auditable change management process.
✗
Use the Terraform CLI in the CI/CD pipeline with remote state
Why it's wrong here
Utilizing the Terraform CLI in a CI/CD pipeline with remote state allows for automated execution and shared state, improving consistency over local runs. However, this approach, by itself, does not natively incorporate mechanisms for policy enforcement or mandatory code review within the Terraform workflow. While a CI/CD pipeline can be configured with custom steps for review, the CLI itself doesn't provide the integrated policy-as-code capabilities or structured approval gates found in dedicated platforms.
✗
Run terraform apply locally after manual approval
Why it's wrong here
Running `terraform apply` locally, even after a manual approval, introduces significant risks and lacks proper governance. This method bypasses centralized control, audit trails, and consistent execution environments, making it prone to configuration drift and human error. Furthermore, 'manual approval' in this context typically doesn't equate to a structured code review process with automated policy validation, failing to enforce critical security and compliance checks.

Go deeper

TF-004 Use Terraform outside the core workflow Practice Question

Why each option matters

Option-by-option breakdown

Related to this question