Scalable Terraform Configuration Design

TERRAFORM-PRO-002 · 43 questions

• A platform team must make sure every AWS resource in dev, staging and prod carries CostCenter and Owner tags. Engineers currently add a tags argument to each of roughly 200 resources by hand, and audits keep finding gaps. Which approach meets the requirement once, in code, with the least per-resource effort?
• The business wants the same web tier in three availability zones with different instance counts per zone, and expects to add or remove zones later without disturbing the zones that remain. Which input design should the module use?
• A compliance rule says no storage bucket may ever be publicly readable. The bucket module exposes a variable that controls the bucket's public-access setting. The team wants a violating value to stop the run during plan, before Terraform creates or changes anything. Where should the rule be expressed?
• A product team asks for environments in small, medium and large sizes. They should never need to know instance types or node counts, and any size other than those three must be rejected. How should the module translate the requirement into code?
• To meet a business rule that the production database must never be deleted by accident, an engineer adds lifecycle { preventdestroy = true } to it. Months later a refactoring pull request deletes the database's entire resource block from the configuration. What does terraform plan do?
• Two engineers run terraform plan on the same commit and get different results, because their machines selected different minor versions of the same provider. The repository's .gitignore excludes .terraform.lock.hcl. What change makes provider selection reproducible across laptops and CI?
• A root variable carrying a database password appears in clear text in plan output in CI logs. The team wants it hidden from CLI output today and needs to understand what risk remains afterwards. Which statement describes the right change and its limits?
• A team needs a database administrator password to be supplied at apply time and never written to the plan file or to state. The provider's database resource offers a write-only password argument. Which configuration meets the requirement?
• Every terraform plan shows in-place tag updates on dozens of resources, even immediately after a successful apply with no code changes. The shared tags local includes CreatedAt = timestamp(). What is causing the perpetual diff?
• A module accepts an instancecount input. Any value above 20 must stop the run before Terraform makes a single provider API call. A teammate proposes a check block that asserts var.instancecount <= 20. Which approach meets the requirement?
• A subnet is created with 10.1.9.0/24 instead of 10.1.1.0/24. The root module declares variable appcidr with default 10.1.1.0/24, sets local.subnetcidr = var.appcidr, and passes the local to a network module. The directory holds terraform.tfvars with appcidr = 10.1.1.0/24 and prod.auto.tfvars with appcidr = 10.1.9.0/24. Where does the wrong value come from?
• A module declares variable instancetype with default t3.small, and terraform.tfvars sets it to t3.large. A local is defined as instancetype = var.environment == "prod" ? "m5.xlarge" : var.instancetype. With environment set to prod, an output shows m5.xlarge although the team expected t3.large. What explains the result?
• A root module declares output dbendpoint with value = module.database.endpoint. terraform plan fails with an Unsupported attribute error saying the module object has no attribute named endpoint. The child module creates the database instance but declares no outputs. What fixes it?
• A CI job exports TFVARregion=eu-west-1, but terraform plan keeps using us-east-1. No -var or -var-file options are passed, and the variable's default is eu-central-1. Which explanation fits these symptoms?
• While debugging tags, an engineer opens terraform console and evaluates local.tags, defined as merge(var.basetags, var.teamtags), where basetags is {Owner = "platform", Env = "dev"} and teamtags is {Owner = "payments"}. What does local.tags["Owner"] return?
• A configuration declares resource "awsiamuser" "this" with foreach = toset(["alice", "bob", "carol"]). An operator must force replacement of only alice's user. Which address should be passed to terraform apply -replace?
• A module takes variable buckets of type list(string) and a resource uses foreach = var.buckets. terraform plan fails because foreach received a list. What is the correct fix?
• A resource uses count = length(var.queuenames) with ["orders", "billing", "audit"]. After billing is removed from the list, the plan replaces the audit queue and destroys another instance. Why does this happen, and what prevents it?
• An awseip resource uses foreach = toset(awsinstance.app[].id). On a fresh environment, terraform plan fails because the foreach value depends on resource attributes that cannot be determined until apply. What is the recommended fix?
• A security group uses dynamic "ingress" with foreach = var.rules, where var.rules is a list of objects with port and cidr attributes, and content sets fromport = ingress.value.port. One generated rule has the wrong port. Inside content, what do ingress.key and ingress.value refer to?
• A module sets instancetype = lookup(var.instancesizes, var.environment, "t3.micro"), where instancesizes is {dev = "t3.small", prod = "m5.large"} and environment is staging. What value does the expression produce?
• A network module computes subnet addresses with cidrsubnet(). What does cidrsubnet("10.0.0.0/16", 8, 2) return?
• A local builds subnet pairs with flatten([for tier, subnets in local.network : [for s in subnets : { tier = tier, subnet = s }]]), where local.network is {app = ["a", "b"], db = ["c"]}. What does the expression produce before it is converted for foreach?
• A module defines local.name = coalesce(var.overridename, var.defaultname) with overridename = null and defaultname = "web", and local.port = try(local.config.port, 8080), where local.config is yamldecode() of a file that has no port key. What are the two values?
• A local is defined as admins = { for name, role in var.users : name => role if role == "admin" }, where var.users is {alice = "admin", bob = "dev", carol = "admin"}. What is the value of local.admins?
• In Terraform 1.15, a module decodes JSON into local.raw and needs it as exactly list(object({ name = string, port = optional(number, 443) })), with the port default applied to entries that omit it, instead of relying on type inference. Which expression does that?
• An application server must be replaced whenever local.appconfighash changes. Adding replacetriggeredby = [local.appconfighash] to the server's lifecycle block fails validation. Which change achieves the replacement trigger?
• After every update to a CDN distribution, the team must invalidate its cache. Today a local-exec provisioner calls a vendor CLI. Their provider, used with Terraform 1.14 or later, now offers an action that performs the invalidation. How should they wire it to run after each update without managing it as a resource?
• A module takes variable settings of type object({ name = string, retentiondays = number, encrypted = bool }). Callers must be able to pass only name, with retentiondays defaulting to 30 and encrypted defaulting to true. How should the type constraint change?
• A data source selects the most recent image for an application, and the image must be built for the x8664 architecture. If the source returns any other architecture, the run must fail with a clear message before instances are created from it. Which configuration does that?
• A configuration must run a local migration script every time var.schemaversion changes, and the team wants to drop the null provider. Which configuration achieves this with built-in features only?
• A team wants Terraform to assert after every plan and apply that its public health endpoint returns HTTP 200. A failure must be reported but must never block a deployment, and HCP Terraform health assessments should keep evaluating it between runs. Which construct fits?
• One configuration must create a primary bucket in us-east-1 and a replica bucket in us-west-2 using the AWS provider. How should the providers be configured?
• A reusable replication module, called with foreach, needs a second AWS provider configuration for its replica resources. The root defines provider "aws" with alias = "west". How should the module receive that configuration?
• A configuration uses resource "datadogmonitor" but has no requiredproviders entry for it. terraform init fails because it tries to install hashicorp/datadog, which does not exist. What fixes the installation?
• A provider "aws" block in a repository contains a hard-coded access key and secret key. Runs execute in HCP Terraform workspaces. What is the recommended remediation?
• A CI runner in an air-gapped network cannot reach the public Terraform Registry, and terraform init fails to download providers. Which approach lets init install providers inside the isolated network?
• A module declares version = "~> 5.3" for a provider in requiredproviders. Which provider versions does this constraint allow?
• An AI coding agent keeps generating provider arguments that were deprecated or removed in the provider version the team uses. The team wants the agent to keep working with the current provider release. What should they add to the agent's toolchain?
• A team wants an AI agent to write a call to a public registry module without guessing its interface. The agent is connected to the Terraform MCP server. What workflow should the agent follow?
• A developer wants to run the Terraform MCP server for an AI assistant inside a local IDE. Separately, a platform team plans a shared instance that many remote clients will reach over the network. Which transport choices fit HashiCorp's guidance?
• An AI agent connected through the Terraform MCP server can create, update and delete HCP Terraform workspaces and their variables. Security asks for safeguards before the agent is used against the production organization. Which safeguards fit HashiCorp's guidance?
• A team starts merging Terraform code generated by an AI agent connected to the Terraform MCP server. A reviewer asks whether the usual pipeline gates still need to apply to that code. What is the correct policy?