Core Concepts & Philosophy
What is the Terraform state file, and why is it considered the source of truth even if the cloud provider has its own API?
Explain the difference between a declarative tool like Terraform and an imperative tool like Ansible or shell scripts.
Explain the difference between the 'Desired State' and the 'Current State' in the context of a Terraform run.
How does Terraform's provider plugin architecture work, and how does it let Terraform remain provider-agnostic?
What are the trade-offs of using a 'Cloud-Agnostic' tool like Terraform versus a 'Cloud-Native' tool like AWS CloudFormation or Azure Bicep?
From a software engineer's perspective, what are the trade-offs of using HCL (Terraform) versus a real programming language like TypeScript or Python (Pulumi/AWS CDK)?
Workflow & Cli Lifecycle
What exactly happens during terraform init, and if you add a new provider to your configuration why do you have to run init again?
What is the difference between terraform plan and terraform apply, and why is it a best practice to save a plan file?
What is the difference between terraform validate and terraform fmt?
What does the terraform console command do, and how is it useful during development?
What is the risk of using -auto-approve, and in what contexts is it acceptable?
Explain the Terraform lifecycle (Init, Plan, Apply, Destroy). What happens under the hood during each step?
What is the difference between terraform apply and terraform apply with a planfile?
What does a terraform plan actually represent, and does a successful plan guarantee a successful apply: why or why not?
In a CI/CD pipeline, why is it important to run terraform plan and terraform apply in separate stages with a manual approval step?
What does the terraform graph command produce, and how can it help you understand your configuration?
Variables Outputs & Locals
What is the conceptual difference between an input variable and a local value, and when is it a best practice to use a local?
Explain the difference between output values and variable inputs.
What is the purpose of the terraform output command, and how do you consume outputs programmatically?
How do you handle sensitive data like passwords or API keys that ends up in the plain-text state file?
How does Terraform determine variable precedence if a value is defined in a .tfvars file, an environment variable, and a default value?
What does marking a variable or output as 'sensitive' actually do, and what are its limitations?
Hcl Expressions & Types
How does the ternary conditional expression work in HCL, and when would you use it?
What are the major categories of Terraform's built-in functions, and can you give examples of when you'd use string, collection, or numeric functions?
What is a heredoc in HCL, and when would you use one over normal string interpolation?
What are for-expressions in HCL, and how do you use them to transform a list or map into another collection?
What is a splat expression in Terraform, and what problem does it solve when working with lists of resources?
What are the different type constraints in Terraform (string, number, bool, list, map, set, object, tuple), and why do complex types matter?
How does type conversion work in Terraform, and what functions help convert between types?
What do the try() and can() functions do, and when are they useful for handling dynamic or uncertain values?
What is the optional() modifier in object type definitions, and how does it help with variable defaults?
Resources Data Sources & Provisioners
What is the difference between a resource block and a data source block?
What are data sources, and how do they allow Terraform to interact with infrastructure it does not manage?
Why are provisioners like local-exec and remote-exec considered a last resort in Terraform? What are the recommended alternatives?
Explain the terraform_data resource (formerly null_resource). When would you use it?
What is the difference between a creation-time and a destroy-time provisioner?
What is the difference between a provider and a provisioner, and why are provisioners like local-exec considered a last resort?
What does the templatefile function do, and when would you use it instead of inline strings or heredocs?
Settings Providers & Versioning
What is the purpose of the terraform {} settings block, and what do required_version and required_providers control?
Explain the purpose of the .terraform.lock.hcl file and why it should be committed to version control.
How do you manage multiple instances of the same provider (e.g., deploying to two different AWS regions) using 'Aliases'?
How do provider version constraints work, and what does an operator like ~> mean in a version constraint?
How can you keep provider credentials out of your configuration, and what are the common ways Terraform authenticates to a cloud provider?
What is the terraform replace-provider command used for, and when would you need it?
Modules & Composition
What is the difference between a 'Root Module' and a 'Child Module'?
What constitutes a 'Terraform Module,' and what are the benefits of using them in a large-scale project?
What is the Terraform Registry, and what is the difference between the public and private versions?
Why is it critical to pin module versions in a production environment, and what are the pros and cons of using a Git URL versus a Terraform Registry source?
What makes a good module? Explain the trade-offs between creating highly generic modules versus specialized, small modules.
Explain the concept of 'Module Composition.' How do you pass data from one module to another?
What is the flat module versus nested module debate, and why is deep nesting of modules generally discouraged in large-scale environments?
How do you balance the DRY principle with the need for infrastructure code to be explicit and easy to audit?
Resource Count Dependencies & Graph
How does Terraform determine the order in which resources are created? Explain the difference between implicit and explicit dependencies.
What is the fundamental difference between using count and for_each to create multiple resources, and which one is safer for resources that might be removed from the middle of a list, and why?
What is a dynamic block, and when would you use one instead of simply defining multiple standard resource blocks?
Can you use count and for_each on module blocks, and how does that change how you call modules?
How does Terraform handle the dependency graph, and what happens if there is a circular dependency?
How does Terraform's resource graph allow it to perform parallel operations?
What does the -parallelism flag control, and why might you lower it during an apply?
Lifecycle & Resource Management
Explain the use cases for create_before_destroy, prevent_destroy, and ignore_changes. How does create_before_destroy help with zero-downtime updates?
How do you rename a resource or move it into a module without Terraform attempting to destroy and recreate it, and why is a moved block preferred over terraform state mv?
What is the difference between the deprecated terraform taint command and the -replace flag in terraform apply?
What is the replace_triggered_by argument in the lifecycle block, and what scenario does it address?
State Management & Backends
What is a 'Remote Backend,' and what are the advantages of using one like S3 or Terraform Cloud over a local backend?
What do terraform state list and terraform state show do, and when would you reach for them?
What is state locking, and why is it required in a team environment? Which backends support it, and what happens if a lock is not released?
What is the difference between terraform state rm and terraform destroy?
Explain the process of migrating state from a local backend to a remote backend such as S3 or Terraform Cloud.
What is the difference between terraform state mv and terraform state rm? When would you use each?
What happens to the state file and the infrastructure if your network connection drops or the CLI process is killed in the middle of a terraform apply, and how does state locking protect against this?
If you inherited a monolith Terraform state file with thousands of resources in one state, what is your conceptual strategy for breaking it into smaller, isolated states?
What happens if the state file is accidentally deleted? How would you attempt to recover or rebuild it?
What is the difference between terraform state pull and terraform state push, and why are they risky?
What is partial backend configuration, and why would you supply backend settings at init time rather than hard-coding them?
How does the terraform_remote_state data source work, and what are the security considerations of exposing another state's outputs?
Drift Import & Refresh
Explain the concept of infrastructure drift. How does Terraform detect it, and what are the strategies for reconciling it?
When would you use terraform import, and what are its limitations regarding the configuration file?
What is the difference between terraform refresh and the newer terraform plan -refresh-only, and when would you use the latter?
When should you use a data source to fetch information about an existing resource versus using the terraform_remote_state data source?
How do you handle importing existing infrastructure into Terraform, and what are the limitations of terraform import vs the new import blocks?
Explain the difference between terraform plan -refresh-only and a standard terraform plan.
Remote Operations & Collaboration
What does the terraform login command do, and how does it relate to authenticating with Terraform Cloud?
Explain the concept of Terraform workspaces. How do they differ from using a separate directory structure for different environments?
What is the difference between a local execution and a remote execution in Terraform Cloud, and how does this affect secrets management?
How does a VCS-driven workflow work in Terraform Cloud, and how does it differ from CLI-driven runs?
Validation Policy & Targeted Operations
When would you use the -target flag, and what are the primary risks of using it in a production environment?
When should you use terraform destroy, and how can you target a specific resource for destruction without affecting the whole stack?
What is a variable validation block, and how do you use it to enforce constraints on input variables?
Explain the concept of Policy as Code (Sentinel or OPA) within the Terraform workflow. At what stage of the plan/apply cycle are these policies enforced?
Explain the purpose of the check block. How does it differ from a standard resource validation or a precondition?
How do precondition and postcondition blocks work, and how do they differ from variable validation?