A pipeline saves a plan with terraform plan -out=tfplan. Reviewers want a human-readable rendering of exactly that plan posted to the pull request, and a policy tool needs a machine-readable version of the same plan. Which approach provides both?
Select an answer to reveal the explanation.
Short Explanation
A saved plan file is a sealed envelope that only Terraform can read. terraform show opens it in plain English for people, and with -json it opens it in a format tools can parse. Running plan again just writes you a new letter, not the one you saved.
Full Explanation
A saved plan file is an opaque binary artifact intended for terraform apply, not a text document. terraform show with the plan file path renders it in the same human-readable form that plan prints, which is suitable for posting to a pull request. Adding -json produces a machine-readable representation of the planned changes, configuration and prior state, which policy and review tools can parse, and because both renderings come from the same file, reviewers and tools see exactly what apply will execute. The file is not HCL or plain text, so attaching it gives reviewers nothing they can read. terraform plan -json does not read a saved plan; it creates a new plan and streams machine-readable UI messages, which may differ from the saved one. terraform output reads output values from state and does not describe planned changes. Exam caveat: HashiCorp warns that show -json displays sensitive values in plain text, so the JSON artifact must be protected like state. Operational check: confirm the review comment and the policy tool both consume artifacts generated from the same tfplan file that the apply job later uses.