An operator suspects someone edited a security group's rules in the cloud console. The team wants to see exactly how the real object differs from what Terraform last recorded, without changing any infrastructure and without updating the state yet. Which command fits?

Refresh-only mode creates a plan whose only goal is to update Terraform's records to match changes made outside Terraform. Running it as terraform plan -refresh-only reads each remote object, compares it with the last state snapshot, and reports the differences, while proposing no changes to infrastructure. Because it is a plan, it also writes nothing to state, which matches the requirement to inspect before deciding. If the team later decides the external change is acceptable, terraform apply -refresh-only records the detected values in state; it does not modify infrastructure, but it does update state immediately, so it does not suit a review-only step. The -refresh=false option disables the synchronization step altogether, which causes Terraform to ignore external changes and can produce an incomplete or incorrect plan, the opposite of drift detection. Showing the resource from state prints only what Terraform recorded at the last refresh or apply, so it cannot reveal a console change that Terraform has not yet read. Exam caveat: a normal plan also refreshes and would reveal the drift, but it mixes drift with proposed corrective changes, which is noisier for this review. Operational check: run the refresh-only plan, read the attributes reported as changed outside of Terraform, and record whether each change should be accepted or reverted.