Exercise 16 ยท 75 minutes

Operate infrastructure over time

Detect controlled drift, adopt an approved existing resource, preserve an address change, and finish with a reviewed destruction plan and verified cleanup.

ModuleOperate changeAzure costNone expectedFinishes withClean sandbox

Before you start

Goal and prerequisites

Your goal

Use plans and explicit state operations to understand changes before reconciling them, then remove every workshop resource safely.

You need

  • The reviewed sandbox from Exercise 14
  • Exercise 15 completed
  • A clean no-change baseline plan
  • An instructor-approved import target name
  • Permission to create and remove managed identities

Participant task

Detect, adopt, move, and remove

  1. 01

    Introduce controlled drift

    Use Azure CLI to change the approved tag on one managed identity. Run a refresh-backed plan and explain how Terraform proposes to reconcile configuration and Azure.

    az identity update --name <identity-name> --resource-group <resource-group> --set tags.<approved-key>=<drift-value>
    terraform plan
  2. 02

    Reconcile deliberately

    Choose whether configuration or the approved Azure value is authoritative. Implement that decision, save a plan, apply it, and confirm a subsequent plan reports no changes.

  3. 03

    Create an import scenario

    Create one instructor-approved disposable managed identity with Azure CLI. Add matching Terraform configuration and an import block that maps its Azure resource ID to the intended address.

    az identity create --name <import-name> --resource-group <resource-group> --location <location> --tags <approved-tags>
  4. 04

    Plan and adopt

    Review the import plan carefully. Resolve any configuration mismatch before apply, then verify the imported address and remove the completed import block.

    terraform plan -out import.tfplan
    terraform apply import.tfplan
    terraform state list
  5. 05

    Move an address safely

    Rename the imported resource's Terraform address and add a moved block. Require a no-destroy plan and confirm its Azure resource ID remains unchanged.

  6. 06

    Decommission the sandbox

    Save and review a destruction plan. Confirm it contains only your workshop resources, apply that exact plan, and verify both Terraform state and Azure are clean.

    terraform plan -destroy -out destroy.tfplan
    terraform show destroy.tfplan
    terraform apply destroy.tfplan
    terraform state list

Expected outcome

Leave evidence and no resources

Validation

  • Drift was visible before reconciliation.
  • Import adopted rather than recreated the resource.
  • The moved address caused no Azure replacement.
  • Final state is empty and Azure contains no exercise resources.

Explain

Describe when import, moved blocks, state repair, and destruction are appropriate, and identify which operations deserve peer review in normal engineering work.

Course complete

Close the sandbox responsibly

Delete local plan files, commit the final configuration and documentation, and provide the cleanup evidence requested by the course owner.

Return to curriculum