Question

Your team manages Catalyst 9000 switch ACLs using Terraform with the ciscoiosxe provider in a CI/CD pipeline. A change request adds three new deny entries to an existing extended ACL. Security policy requires a human to review the exact resource changes before anything is applied to production, and the pipeline must fail if the review is not approved. Which pipeline step design correctly enforces this requirement while keeping runs deterministic?

Accepted Answer

Run `terraform plan -out=tfplan`, publish the saved plan file as a manual approval gate, then run `terraform apply tfplan` only after approval

Answer

Run `terraform apply -auto-approve` and roll back with `terraform destroy` if the reviewer rejects the change afterward

Answer

Run `terraform refresh` before every apply so the state always matches the device, then apply without saving a plan

Answer

Run `terraform plan` for display, then run a separate `terraform apply` that regenerates its own plan after approval