Declarative infrastructure, state, and the ways it goes wrong.
30 items at beginner level · all topics
A team is replacing a set of shell scripts that call cloud provider CLIs. The scripts have to be read top to bottom to work out what infrastructure currently exists, and re-running one usually fails because a resource it tries to create is already there. Which characteristic of Terraform addresses both problems?
Scripts describe steps, Terraform describes an end state. That single difference is what removes the "work out what already exists" reading and the "fails on the second run" problem at the same time.
A colleague asks what a Terraform provider actually is, given that Terraform can manage AWS, GitHub and PagerDuty without knowing anything about them. What is the accurate answer?
A provider is a plugin that Terraform downloads and runs. It defines the resource and data source types for one platform and makes the API calls that create, read, update and destroy them.
An application stores objects in AWS, resolves DNS through Cloudflare, and routes alerts through PagerDuty. The team wants one workflow that provisions all three and understands the ordering between them, for example creating the DNS record only after the load balancer exists. Which statement best describes how Terraform supports this?
Terraform is service-agnostic because it speaks to every platform through a provider plugin, not because it hides the platforms behind a generic resource type. One configuration, many providers, one dependency graph.
A platform team is writing the case for moving provisioning out of the cloud console and into version-controlled Terraform configuration. Which TWO of the following are advantages of the infrastructure as code pattern itself, rather than claims about a particular cloud provider or tool?
The real advantages of IaC are the ones that come from infrastructure being a file: it can be reviewed like code, and it can be applied again to produce another identical environment.
A developer applies a configuration successfully. They then run terraform apply a second time, having made no edits to the configuration and no changes to the infrastructure outside Terraform. What does Terraform report, and why?
The second apply reports no changes, and the reason matters as much as the verdict. Terraform refreshes the real resources first, then compares them with the configuration, and only the gap becomes actions.
True or false: Terraform can only manage infrastructure that it created itself, so a resource built by hand in a cloud console can never be brought under Terraform management.
False. Importing is a supported part of the workflow, and it is how teams adopt Terraform for infrastructure that already exists rather than starting from an empty account.
Someone widens a security group rule in the cloud console. The Terraform configuration is unchanged. What is this called, and what does the next terraform plan show?
A change made outside Terraform is drift. The refresh at the start of a plan notices it, and the plan proposes changing the rule back to match the configuration.
A configuration has both a required_providers entry for aws and a provider "aws" block setting a region. A reviewer asks whether one of them is redundant. What does each one do?
required_providers declares which providers the module needs, with their source address and version constraint. A provider block configures one of them, with settings such as region.
An engineer runs terraform init in a second project on the same laptop and watches it download the same AWS provider again. They ask whether the first download was wasted. What is happening?
Providers are installed per working directory, under .terraform, so each project gets its own copy. A shared plugin cache directory can be configured to avoid re-downloading the same package.
A developer clones a repository holding a Terraform configuration and immediately runs terraform plan. Terraform stops with an error saying the working directory has not been initialized. Which of the following does terraform init do that plan depends on?
Init is the setup step: it configures the backend, downloads the provider plugins and fetches the modules into the working directory. None of that is in the repository, which is why a fresh clone cannot plan.
A new engineer asks what the core Terraform workflow is, having only ever run terraform apply. Which sequence describes it, and what does the middle stage add?
The core workflow is write, plan, apply. Plan is the review stage: it shows exactly what would change before anything is changed, which is what makes an apply predictable.
A developer has already initialized a working directory and applied a configuration. They now add a new module block and a new provider to the configuration. A colleague warns that running terraform init again could wipe the existing state. What is the correct assessment?
Init is safe to run as often as you like. It brings the working directory up to date with the configuration and never deletes configuration or state, which is why it is the normal first step after adding a module or a provider.
A repository holds Terraform configuration in a root directory plus several subdirectories of modules. A pipeline step should fail when any file anywhere in the repository is not in canonical style, without rewriting files in CI. Which command does this?
terraform fmt only visits the directory you point it at, so subdirectories need -recursive. Pair it with -check so the step reports a non-zero exit status instead of editing files.
True or false: terraform destroy is the only way to destroy infrastructure that Terraform manages.
False. terraform destroy is a convenience alias for terraform apply -destroy, and removing a resource from the configuration and applying destroys it just as effectively.
A configuration repeats the expression "${var.project}-${var.env}" in eleven resource names. The team wants to write it once. Should that be a variable or a local value?
A local value names an expression for reuse inside one module and cannot be set from outside. An input variable is a value the caller supplies, so it cannot be computed from other variables.
A configuration needs the ID of a VPC that another team created and manages in a separate Terraform workspace. The VPC must not be modified or destroyed by this configuration under any circumstances. Which block type should be used to obtain the ID?
A data block reads an existing object without taking ownership of it. A resource block declares something this configuration creates and destroys, so using one here would put another team's VPC into your state.
A subnet resource needs the id of a VPC declared in the same configuration as aws_vpc.main. Which expression provides it, and what side effect does writing it have?
Write aws_vpc.main.id to read the attribute. The reference also creates an implicit dependency, so Terraform creates the VPC before the subnet without any depends_on.
A configuration declares variable "vpc_cidrs" with type = map(string) and a default of { us-east-1 = "10.0.0.0/16", eu-west-1 = "10.1.0.0/16" }. Which expression returns the CIDR block for us-east-1?
Map values are read with bracket syntax and a key in quotes. Dot notation cannot carry a key containing hyphens, and the other forms address the variable rather than an element of it.
A team has copied the same twelve resource blocks into four environment directories. What does packaging them as a module change, and which files does the standard structure expect?
A module packages resources behind an interface of variables and outputs, so the four callers share one definition. The standard structure expects main.tf, variables.tf and outputs.tf.
A working directory contains main.tf, variables.tf and outputs.tf, and main.tf includes two module blocks that point at directories under ./modules. Which statement correctly describes the module structure?
The working directory is itself a module, the root module. Every module it calls is a child module, and a directory only becomes a module by being called.
A developer adds a new module block pointing at ./modules/networking, a directory that already exists in the repository. Running terraform plan immediately afterwards fails with an error stating that the module is not installed. What should they do?
Adding a module always requires another terraform init, even for a local path. Terraform records module installation in the working directory, and plan will not do that work implicitly.
A state file has an obviously wrong attribute after a failed apply. An engineer proposes opening terraform.tfstate in an editor to correct it. Why is that discouraged, and what exists instead?
State is an internal format that Terraform expects to own, and hand edits bypass every check. The state subcommands, and terraform apply -refresh-only, are the supported ways to change it.
A new team member asks why Terraform keeps a state file at all, given that the configuration describes the desired infrastructure and the cloud provider's API can be queried for what exists. What is the primary reason?
State is the mapping between a resource address in your configuration and the real object it refers to. Without it Terraform could see the objects but would not know which of them is which.
One working directory needs separate state for dev and prod without copying the configuration. A colleague runs terraform workspace new dev. What does that actually give them, and what does it not?
A CLI workspace is an additional named state file for the same working directory and the same configuration. It separates state only, sharing the backend, the providers and the code.
An engineer wants to read the whole current state in human-readable form, and later wants the same information as JSON for a script. Which command covers both?
terraform show prints the current state in readable form, and -json produces a machine-readable version. It also reads a saved plan file, which is how a reviewer inspects a plan.
A CI job needs the load balancer DNS name that a configuration exposes as an output, to pass into a smoke test. Which command retrieves just that value in a script-friendly way?
terraform output NAME prints one output value, and -raw prints it without quotes for use in a shell. The values come from state, so no provider call is made.
During an incident, an engineer needs two things quickly: the addresses of every resource Terraform is managing, and then the full set of recorded attributes for one specific instance. Which commands give them this?
terraform state list prints the addresses, terraform state show prints one resource's recorded attributes. Both read state and neither changes anything.
A team already runs Terraform from laptops with state in an S3 bucket. What does moving to HCP Terraform add that a remote backend alone does not?
A remote backend gives shared state and locking. HCP Terraform adds a place runs execute, with run history, stored variables, access control, policy enforcement and a private module registry.
An HCP Terraform workspace needs an AWS access key for the provider and a value for an input variable named instance_count. How are the two categorised?
HCP Terraform workspace variables come in two categories. Terraform variables set input variables in the configuration; environment variables are exported into the run environment for providers.
A run is queued in an HCP Terraform workspace with auto apply turned off. The plan finishes successfully. What is the state of the run, and what happens next?
The run pauses after a successful plan and waits for confirmation. Someone with apply permission confirms or discards it, and only a confirmed run proceeds to change infrastructure.