TF-004 Read, generate and modify configuration Practice Question
A Terraform configuration uses a for_each expression to create multiple subnets. After applying, one subnet's configuration needs to be modified. The engineer updates the resource block's map key for that subnet. What will terraform plan show?
⚠ Common exam trap
Many candidates confuse a change in the for_each key with a change in the resource's arguments, assuming that identical configuration means no changes, when in fact the key itself is part of the resource identity and forces replacement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destruction of the existing subnet and creation of a new one.
When a for_each expression is used, Terraform identifies each resource instance by its map key. Changing the map key for a subnet causes Terraform to treat the old key as a resource to be destroyed and the new key as a resource to be created, because the key is part of the resource's identity. Even if the configuration inside the block is identical, the change in key results in a destroy-and-create action, not an in-place update.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No changes because the subnet configuration is the same.
Why it's wrong here
This is incorrect because Terraform identifies resources by their unique address, which for `for_each` resources includes the specific key from the `for_each` expression. Even if the *attributes* of the subnet resource remain identical, a change in its `for_each` key means Terraform perceives a completely different resource instance. The old resource, identified by its original key, is no longer present in the configuration, while a new resource, identified by the new key, has appeared.
- ✗
Only deletion of the old subnet.
Why it's wrong here
This option is incomplete. When a `for_each` key is modified, Terraform detects that the resource instance associated with the *original* key no longer exists in the desired state, leading to its planned destruction. However, simultaneously, a *new* resource instance is introduced into the configuration, identified by the *new* `for_each` key. Therefore, Terraform will also plan the creation of this new subnet, making it a two-step operation rather than just a deletion.
- ✗
An in-place update to the subnet.
Why it's wrong here
An in-place update is not possible in this scenario because the `for_each` key is a fundamental component of a resource's unique address and identity within the Terraform state. Modifying this key is not treated as an attribute change that can be updated on an existing resource. Instead, Terraform interprets it as the removal of one distinct resource instance (identified by the old key) and the introduction of an entirely new, separate resource instance (identified by the new key), necessitating a destroy-and-create cycle.
- ✓
Destruction of the existing subnet and creation of a new one.
Why this is correct
This is the correct outcome. The `for_each` key is an integral part of a resource's unique address in the Terraform state. When this key changes, Terraform no longer finds the resource instance identified by the *old* key in the current configuration, marking it for destruction. Concurrently, it identifies a *new* resource instance, defined by the *new* key, which it plans to create. This process ensures that the desired state, reflecting the updated `for_each` keys, is accurately achieved through a destroy-and-create operation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.