Break/Fix: Configuration Committed to Root Instead of Module

Scenario

You have a configuration with a root module that calls a submodule. A developer was supposed to update the submodules variable default but accidentally changed the root modules override. The plan proposes to replace resources.

Your task

Investigate the cause and remediate.

Evidence to discover

# Check the recent commits
git log --oneline -10

# Check the diff
git diff HEAD~1 main.tf

# Check the submodules state
git diff HEAD~1 modules/

# Check the plan output
terraform plan

Questions to answer

1. What changed in the root module? The diff shows the root module changes.
2. What was supposed to change? The change was supposed to be in the submodule.
3. What is the correct remediation? Revert the root module change and apply the correct change in the submodule.

Recovery procedure

(Do not reveal this until the student has reasoned through the problem.)

1. Revert the root module change.

git checkout HEAD~1 -- main.tf

2. Apply the correct change in the submodule.

vim modules/<module>/variables.tf

3. Verify the plan is empty.

terraform plan

The plan is empty.

4. Apply the change.

terraform apply

The apply is a no-op (or applies the submodule change).

Remediation

The cause was the developer modifying the root module instead of the submodule. The fix was to revert the root module change and apply the correct change in the submodule.

Prevention

• Use the moved block when refactoring modules.
• Test the change in a development environment.
• Have a second engineer review the PR.
• Use pre-commit hooks to validate the configuration.

What you learned

• A configuration change has a root cause. The root cause is the developer modifying the wrong module.
• The plan output is the diagnostic. The plan shows the unexpected change.
• The fix is to revert the wrong change and apply the correct change.
• The prevention is to use the moved block and review PRs.