Terraform Security and Governance

TERRAFORM-PRO-002 · 43 questions

• Auditors find database passwords in plaintext inside a terraform.tfstate object in the S3 bucket used as a team's backend. Every engineer in the account can read the bucket, and server-side encryption is off. Which response addresses the finding?
• A child module builds a database connection string from a sensitive password variable and exposes it as output connstring with sensitive = true. The root module declares output "dbconn" { value = module.db.connstring }, and terraform plan fails with an error saying the output refers to sensitive values. What is the correct fix?
• A team's awsdbinstance sets password from a sensitive variable, and the password appears in state. The provider version they use offers the write-only argument passwordwo with a companion passwordwoversion argument. What is the effect of switching to passwordwo?
• A root module declares variable "dbpassword" with ephemeral = true and assigns var.dbpassword to the password argument of a database resource. terraform plan fails because an ephemeral value is used where it is not allowed. The provider version also offers a write-only password argument for that resource. Which change fixes the error and keeps the password out of state?
• A developer committed prod.auto.tfvars containing a third-party API key to the main branch of a shared repository, and the commit was pushed an hour ago. Which response best addresses the exposure?
• A root configuration sets accesskey and secretkey directly in the aws provider block, read from variables whose default values are committed to the repository. The team runs Terraform both from laptops and from HCP Terraform workspaces. What is the recommended change?
• A networking workspace in HCP Terraform publishes VPC and subnet IDs as outputs. Ten application teams read them with the tfeoutputs data source, and each team holds the Read workspace role on the networking workspace, which also lets them download complete state containing secrets. What is the least-privilege fix?
• An engineer plans to attach TFLOG=TRACE output from a failing production apply to a public issue on a provider's GitHub repository. What should the team consider before sharing it?
• To debug a failing connection, a developer adds output "dbpassword" { value = nonsensitive(var.dbpassword) } to a shared module, where var.dbpassword is declared with sensitive = true, and merges the change. What is the main risk?
• A configuration reads a database admin password from Vault's KV version 2 engine with a data source and passes it to a database resource's password argument, so the password appears in state. The Vault provider and the database resource both support Terraform's ephemeral and write-only features. Which pattern keeps the password out of state entirely?
• A database resource sets its password through a write-only argument fed by an ephemeral value, with the companion version argument set to 1. Security rotates the password in Vault, but terraform plan reports no changes. How should the team push the new password to the database?
• A compliance scan finds Vault-sourced API keys in an HCP Terraform workspace's state. The configuration reads them with a vaultkvsecretv2 data source and passes them to the provider block of a SaaS provider. Why are the keys in state, and what removes them?
• A team wants the database credentials Terraform uses during each run to be created on demand and to expire automatically shortly after the run, so no credential outlives the run that used it. They already operate Vault. Which approach fits?
• Every CI pipeline in a company authenticates to HCP Terraform with one team API token created two years ago with no expiration date, and a pipeline log once leaked it. What should the platform team implement going forward?
• Applications read a database password from AWS Secrets Manager, and a separate rotation function changes the value monthly. Terraform should create the secret and its access policy but must never hold the password or conflict with the rotation. What should the configuration manage?
• A module generates a database password with the randompassword resource and passes its result to a resource's write-only password argument, yet the password still appears in state. The random provider version in use supports ephemeral resources. What change keeps the generated password out of state?
• Several running services authenticate to a partner API with a key that Terraform provisions. The key must be rotated without any service losing access during the change. Which sequence achieves this?
• A company's dev and prod Terraform pipelines both assume one cloud role with administrator permissions. A compromised job in the dev pipeline could therefore change production. What is the recommended remediation?
• A deployment pipeline authenticates to HCP Terraform with a user API token that belongs to a senior engineer who is leaving the company next month. What should replace it?
• A production HCP Terraform workspace uses the VCS-driven workflow with auto-apply enabled on the main branch. Any developer with repository write access can push directly to main, which immediately applies to production. Which control set best reduces this risk?
• An open-source infrastructure repository runs terraform plan in CI for every pull request, including pull requests from forks, and the plan job has access to cloud credentials so it can refresh real resources. What is the main risk, and the fix?
• An HCP Terraform agent pool runs inside a restricted network segment that can reach payment systems. Any workspace in the organization can currently select the pool in its settings. How should access be limited?
• A GitHub Actions workflow assumes an AWS production role through OIDC. The role's trust policy checks only the audience and that the subject begins with the organization's repository path, so a workflow on any feature branch can assume it. How should the trust be tightened?
• A production workspace in HCP Terraform was destroyed overnight, and security needs to establish who queued the destroy run and who confirmed it. Which source should they use?
• Fifteen engineers belong to the owners team of an HCP Terraform organization, mostly so they can manage workspaces for their own applications. What change best follows least privilege?
• Developers hold the Write role on a production HCP Terraform workspace that uses the VCS-driven workflow. One developer ran terraform state rm against it from a laptop, and another downloaded the full state, which contains secrets. Developers still need to read runs and queue plans. Which access model fits?
• A platform team's engineers already write Rego policies for Kubernetes admission control. They want HCP Terraform to evaluate Terraform plans against policies written in the same language and enforce them on runs in selected projects. What should they use?
• A compliance rule says no run may create a public storage bucket, and no user, including organization owners, may override a failure. The team writes its policies in Sentinel. How should enforcement be configured?
• A platform team runs HCP Terraform for 40 workspaces across five projects. Security requires that encryption rules apply to every workspace, including ones created next year, while a cost-center tagging rule must apply only to workspaces in the analytics project. How should the team organize its policies?
• A hotfix run in a production HCP Terraform workspace stops because a Sentinel policy set to soft-mandatory fails. Security has reviewed the change and approved it as a one-time exception. What lets the run proceed while keeping the policy in place?
• A compliance lead wants every change to the organization's Sentinel policies to go through pull-request review and leave a full history, and wants HCP Terraform to start enforcing a merged change without anyone copying code into the UI. Which approach meets this requirement?
• A policy author has written a new Sentinel policy that blocks public storage buckets. Before it can stop anyone's run, the author wants evidence that it passes compliant plans and fails non-compliant ones, and then wants to watch its behavior on real runs for a week. What is the recommended approach?
• A team writes Sentinel policies that need to examine the attribute values Terraform intends to set, so non-compliant changes are stopped before anything is modified. At what point in an HCP Terraform run does policy evaluation occur?
• A global Sentinel policy set restricts compute instance types to an approved list. The machine learning team, whose workspaces all sit in their own HCP Terraform project, has an approved business need for GPU instance types that the list excludes. How should the platform team accommodate them?
• A newly formed cloud governance team must enforce the CIS AWS Foundations benchmark in HCP Terraform within weeks and has no Sentinel authors on staff. What is the most direct way to obtain enforceable policies?
• An engineer changes the name argument on a production managed database resource to match a new naming standard. The plan marks the database with -/+ and shows # forces replacement beside the name attribute. What does the plan mean?
• A team decommissions a staging environment, but terraform destroy fails with an error that a database instance cannot be destroyed because lifecycle.preventdestroy is set. The team lead confirms the database must really be deleted. What is the correct way to proceed?
• Security requires that a third-party scanning service inspect every planned change in production HCP Terraform workspaces and be able to stop a run when it finds a critical issue. How should the platform team integrate the scanner?
• A team wants obvious configuration mistakes, such as invalid references, unformatted files and known insecure settings, caught on every pull request before any terraform plan runs or any cloud credentials are used. Which addition to the CI pipeline meets this goal?
• An organization decides that any HCP Terraform run deleting resources in production workspaces must stop and receive explicit approval from a designated reviewer group, while runs that only create or update resources proceed normally. Which control meets this requirement?
• A company manages its network, databases and dozens of applications from one root configuration with a single state. A typo in an application change recently planned the replacement of a shared subnet, and every plan takes 25 minutes. Which change best reduces the risk and blast radius of routine changes?
• A platform team is building an automated reviewer for pull requests that must count how many resources a plan will delete or replace and fail the check above a threshold. Which approach gives the reviewer reliable, structured data to analyze?
• Two engineers start terraform apply against the same production configuration at almost the same moment. One uses a remote backend that supports locking; another team runs the same configuration as an HCP Terraform workspace. What prevents conflicting writes to state in each case?