←

# terraform & iac

// [30] real interview questions. Answers and sources live in the practice app.

practice this topic
  1. A coworker force-pushed a broken state to the shared S3 backend and now `terraform plan` wants to destroy half of production. What happened and how do you recover?(senior)
  2. Two engineers run `terraform apply` at the same time against the same backend. What does state locking do here, and what happens if the backend doesn't support it?(mid)
  3. Why is committing terraform.tfstate to your Git repo a bad idea, even for a small team?(mid)
  4. Your app needs a database password. If you put it in a Terraform variable and create the RDS instance, where does that secret end up, and how do you handle it responsibly?(mid)
  5. There's a production security group someone created by hand in the console. You want Terraform to manage it going forward without recreating it. Walk through how.(mid)
  6. A plan output shows `~ update in-place`, `-/+ destroy and then create replacement`, and `+/- create replacement then destroy`. In a review under time pressure, which symbols make you stop and why?(mid)
  7. You used `count` to create 5 S3 buckets from a list. Someone removes the 2nd item from the list. What does Terraform plan to do, and why is `for_each` often the fix?(senior)
  8. Overnight someone changed an autoscaling group's min size in the AWS console. Your next `terraform plan` wants to set it back. What is this, and what are your options?(mid)
  9. A teammate suggests using Terraform workspaces to separate dev, staging, and prod. Why is that often the wrong tool, and what's the common alternative?(senior)
  10. You're designing a reusable module for other teams. What should its interface and layout look like, and what anti-patterns will you avoid?(mid)
  11. Why should a shared module pin its provider and Terraform version constraints, and how do you consume the module with the same discipline?(mid)
  12. You bump the AWS provider from v4 to v5 and `terraform plan` suddenly shows dozens of unexpected changes and a couple of errors. How do you approach a provider upgrade safely?(senior)
  13. Design a CI pipeline for Terraform. What runs on a pull request versus on merge to main, and why not just apply on every push?(senior)
  14. What is 'blast radius' in Terraform, and how does splitting your infrastructure into multiple states control it?(senior)
  15. Someone runs `terraform destroy` in the prod directory. What guardrails should have stopped this, and how do you protect critical resources?(mid)
  16. When does reaching for Terragrunt make sense, and when is it over-engineering?(senior)
  17. Your org wants to guarantee no one can create an untagged or public S3 bucket via Terraform. How do you enforce that with policy as code?(senior)
  18. A backend engineer asks why Terraform even keeps a state file — can't it just query the cloud API every time? Give the real reasons.(mid)
  19. You need to rename a resource from `aws_instance.app` to `aws_instance.api` in your config. If you just rename it, what does Terraform do, and how do you rename safely?(mid)
  20. A resource in state got deleted manually in the cloud, but you don't want Terraform to recreate it — you want to forget it. And separately, a state entry is stale. How do you handle each?(mid)
  21. What does `terraform init` actually do, and why is committing the .terraform.lock.hcl file important for a team?(mid)
  22. You want drift detection to run automatically so out-of-band changes don't pile up silently. How would you build it, and what do you do with the results?(senior)
  23. What is a Terraform provider, and is it true that providers can only come from HashiCorp?(mid)
  24. A variable should only accept an environment of dev, staging, or prod, and an instance count greater than zero. How do you enforce that in Terraform instead of failing at apply time?(junior)
  25. You're setting up the S3 remote backend for the first time, but the backend needs an S3 bucket and a lock mechanism that Terraform would also manage. How do you resolve this chicken-and-egg, and what does the backend block need?(mid)
  26. A plan says a resource will be replaced but you know the change is actually safe to apply live. What levers does `lifecycle` give you, and what are the risks of each?(senior)
  27. Your team debates adopting OpenTofu instead of Terraform after the license change. What actually differs, and what should drive the decision?(senior)
  28. In a big plan, a single resource is misconfigured and you want to apply just that one to test, without touching everything else. What are your options and the caveat?(mid)
  29. How do you share outputs from one Terraform configuration (say, a VPC's subnet IDs) with another configuration that manages apps?(mid)
  30. You edited the .tf files and want to know exactly what will change before touching real infrastructure. What's the safe workflow, and why save the plan to a file?(junior)