Resource Count Dependencies & Graph
Can you use count and for_each on module blocks, and how does that change how you call modules?
How does Terraform determine the order in which resources are created? Explain the difference between implicit and explicit dependencies.
How does Terraform handle the dependency graph, and what happens if there is a circular dependency?
How does Terraform's resource graph allow it to perform parallel operations?
What does the -parallelism flag control, and why might you lower it during an apply?
What is a dynamic block, and when would you use one instead of simply defining multiple standard resource blocks?
What is the fundamental difference between using count and for_each to create multiple resources, and which one is safer for resources that might be removed from the middle of a list, and why?
Modules & Composition
Explain the concept of 'Module Composition.' How do you pass data from one module to another?
How do you balance the DRY principle with the need for infrastructure code to be explicit and easy to audit?
What constitutes a 'Terraform Module,' and what are the benefits of using them in a large-scale project?
What is the difference between a 'Root Module' and a 'Child Module'?
What is the flat module versus nested module debate, and why is deep nesting of modules generally discouraged in large-scale environments?
What is the Terraform Registry, and what is the difference between the public and private versions?
What makes a good module? Explain the trade-offs between creating highly generic modules versus specialized, small modules.
Why is it critical to pin module versions in a production environment, and what are the pros and cons of using a Git URL versus a Terraform Registry source?
Drift Import & Refresh
Explain the concept of infrastructure drift. How does Terraform detect it, and what are the strategies for reconciling it?
Explain the difference between terraform plan -refresh-only and a standard terraform plan.
How do you handle importing existing infrastructure into Terraform, and what are the limitations of terraform import vs the new import blocks?
What is the difference between terraform refresh and the newer terraform plan -refresh-only, and when would you use the latter?
When should you use a data source to fetch information about an existing resource versus using the terraform_remote_state data source?
When would you use terraform import, and what are its limitations regarding the configuration file?
Validation Policy & Targeted Operations
Explain the concept of Policy as Code (Sentinel or OPA) within the Terraform workflow. At what stage of the plan/apply cycle are these policies enforced?
Explain the purpose of the check block. How does it differ from a standard resource validation or a precondition?
How do precondition and postcondition blocks work, and how do they differ from variable validation?
What is a variable validation block, and how do you use it to enforce constraints on input variables?
When should you use terraform destroy, and how can you target a specific resource for destruction without affecting the whole stack?
When would you use the -target flag, and what are the primary risks of using it in a production environment?
Remote Operations & Collaboration
Explain the concept of Terraform workspaces. How do they differ from using a separate directory structure for different environments?
How does a VCS-driven workflow work in Terraform Cloud, and how does it differ from CLI-driven runs?
What does the terraform login command do, and how does it relate to authenticating with Terraform Cloud?
What is the difference between a local execution and a remote execution in Terraform Cloud, and how does this affect secrets management?
Core Concepts & Philosophy
Explain the difference between a declarative tool like Terraform and an imperative tool like Ansible or shell scripts.
Explain the difference between the 'Desired State' and the 'Current State' in the context of a Terraform run.
From a software engineer's perspective, what are the trade-offs of using HCL (Terraform) versus a real programming language like TypeScript or Python (Pulumi/AWS CDK)?
How does Terraform's provider plugin architecture work, and how does it let Terraform remain provider-agnostic?
What are the trade-offs of using a 'Cloud-Agnostic' tool like Terraform versus a 'Cloud-Native' tool like AWS CloudFormation or Azure Bicep?
What is the Terraform state file, and why is it considered the source of truth even if the cloud provider has its own API?
Variables Outputs & Locals
Explain the difference between output values and variable inputs.
How do you handle sensitive data like passwords or API keys that ends up in the plain-text state file?
How does Terraform determine variable precedence if a value is defined in a .tfvars file, an environment variable, and a default value?
What does marking a variable or output as 'sensitive' actually do, and what are its limitations?
What is the conceptual difference between an input variable and a local value, and when is it a best practice to use a local?
What is the purpose of the terraform output command, and how do you consume outputs programmatically?
State Management & Backends
Explain the process of migrating state from a local backend to a remote backend such as S3 or Terraform Cloud.
How does the terraform_remote_state data source work, and what are the security considerations of exposing another state's outputs?
If you inherited a monolith Terraform state file with thousands of resources in one state, what is your conceptual strategy for breaking it into smaller, isolated states?
What do terraform state list and terraform state show do, and when would you reach for them?
What happens if the state file is accidentally deleted? How would you attempt to recover or rebuild it?
What happens to the state file and the infrastructure if your network connection drops or the CLI process is killed in the middle of a terraform apply, and how does state locking protect against this?
What is a 'Remote Backend,' and what are the advantages of using one like S3 or Terraform Cloud over a local backend?
What is partial backend configuration, and why would you supply backend settings at init time rather than hard-coding them?
What is state locking, and why is it required in a team environment? Which backends support it, and what happens if a lock is not released?
What is the difference between terraform state mv and terraform state rm? When would you use each?
What is the difference between terraform state pull and terraform state push, and why are they risky?
What is the difference between terraform state rm and terraform destroy?
Settings Providers & Versioning
Explain the purpose of the .terraform.lock.hcl file and why it should be committed to version control.
How can you keep provider credentials out of your configuration, and what are the common ways Terraform authenticates to a cloud provider?
How do provider version constraints work, and what does an operator like ~> mean in a version constraint?
How do you manage multiple instances of the same provider (e.g., deploying to two different AWS regions) using 'Aliases'?
What is the purpose of the terraform {} settings block, and what do required_version and required_providers control?
What is the terraform replace-provider command used for, and when would you need it?
Workflow & Cli Lifecycle
Explain the Terraform lifecycle (Init, Plan, Apply, Destroy). What happens under the hood during each step?
In a CI/CD pipeline, why is it important to run terraform plan and terraform apply in separate stages with a manual approval step?
What does a terraform plan actually represent, and does a successful plan guarantee a successful apply: why or why not?
What does the terraform console command do, and how is it useful during development?
What does the terraform graph command produce, and how can it help you understand your configuration?
What exactly happens during terraform init, and if you add a new provider to your configuration why do you have to run init again?
What is the difference between terraform apply and terraform apply with a planfile?
What is the difference between terraform plan and terraform apply, and why is it a best practice to save a plan file?
What is the difference between terraform validate and terraform fmt?
What is the risk of using -auto-approve, and in what contexts is it acceptable?
Resources Data Sources & Provisioners
Explain the terraform_data resource (formerly null_resource). When would you use it?
What are data sources, and how do they allow Terraform to interact with infrastructure it does not manage?
What does the templatefile function do, and when would you use it instead of inline strings or heredocs?
What is the difference between a creation-time and a destroy-time provisioner?
What is the difference between a provider and a provisioner, and why are provisioners like local-exec considered a last resort?
What is the difference between a resource block and a data source block?
Why are provisioners like local-exec and remote-exec considered a last resort in Terraform? What are the recommended alternatives?
Lifecycle & Resource Management
Explain the use cases for create_before_destroy, prevent_destroy, and ignore_changes. How does create_before_destroy help with zero-downtime updates?
How do you rename a resource or move it into a module without Terraform attempting to destroy and recreate it, and why is a moved block preferred over terraform state mv?
What is the difference between the deprecated terraform taint command and the -replace flag in terraform apply?
What is the replace_triggered_by argument in the lifecycle block, and what scenario does it address?
Hcl Expressions & Types
How does the ternary conditional expression work in HCL, and when would you use it?
How does type conversion work in Terraform, and what functions help convert between types?
What are for-expressions in HCL, and how do you use them to transform a list or map into another collection?
What are the different type constraints in Terraform (string, number, bool, list, map, set, object, tuple), and why do complex types matter?
What are the major categories of Terraform's built-in functions, and can you give examples of when you'd use string, collection, or numeric functions?
What do the try() and can() functions do, and when are they useful for handling dynamic or uncertain values?
What is a heredoc in HCL, and when would you use one over normal string interpolation?
What is a splat expression in Terraform, and what problem does it solve when working with lists of resources?
What is the optional() modifier in object type definitions, and how does it help with variable defaults?