A pipeline must run terraform apply without an interactive prompt. The security lead wants the change that executes to be exactly the change that was reviewed earlier in the pipeline. Which approach meets both requirements?

Without a plan file, terraform apply creates a new plan and prompts for approval. Two routes avoid the prompt. The -auto-approve option skips interactive approval of the plan that apply computes at that moment, which means the executed changes are whatever Terraform finds at apply time, not necessarily what reviewers saw earlier. Passing a saved plan file performs the operations in that file without prompting, because the documentation treats passing the file as the approval, and Terraform ignores -auto-approve in that mode. Only the saved-plan route satisfies the security lead's requirement. The -auto-approve option never reuses earlier plan output, so the first alternative misdescribes it. The -input=false option disables interactive prompts for values such as variables; it is not a form of approval, and without a plan file or -auto-approve apply cannot proceed unattended. The approval prompt has nothing to do with state locking, and -lock=false only disables locking, which is dangerous when others may run commands concurrently. Exam caveat: HashiCorp recommends -auto-approve only where nobody can change infrastructure outside the pipeline, and manual review is strongly recommended for production. Operational check: have the review stage run plan -out and publish terraform show output, and have the apply stage consume the same artifact by checksum.