Question 610
A platform team updates a shared Terraform module and several projects unexpectedly replace subnets during the next apply. Which limitation must be considered before claiming the issue is fully resolved?
Explanation
Correct Answer
Version pinning reduces surprise but does not validate the module's own logic. This caution prevents extrapolating beyond the specific evidence or product boundary. Reusable IaC requires dependency control and change impact review. The unresolved point should be tested using module version references, Terraform plans and shared state history rather than assuming a working interface proves full compliance or resilience.
Incorrect Answers
Pinning a version alone proves the module contains no security issue. This limitation is framed as a blanket exception, but the case requires a different, narrower caution. The relevant boundary is that version pinning reduces surprise but does not validate the module's own logic. Reusable IaC requires dependency control and change impact review. Inspect module version references, Terraform plans and shared state history.
Version pinning provides an immutable guarantee even for mutable tag names. The proposed claim mistakes an incomplete signal or product feature for a universal guarantee. The relevant boundary is that version pinning reduces surprise but does not validate the module's own logic. Reusable IaC requires dependency control and change impact review. Inspect module version references, Terraform plans and shared state history.
A valid Terraform configuration means every replacement operation is safe. This claim exceeds the evidence and ignores an important risk or operational dependency. The relevant boundary is that version pinning reduces surprise but does not validate the module's own logic. Reusable IaC requires dependency control and change impact review. Inspect module version references, Terraform plans and shared state history.