Terraform State and Backend Operations

TERRAFORM-PRO-002 · 43 questions

• A team using the S3 backend wants state locking without maintaining a DynamoDB table, since the DynamoDB locking arguments are now deprecated. Which configuration should they adopt?
• A backend "s3" block sets bucket = var.statebucket so each environment can use its own bucket, and terraform init fails. How should the team supply a different bucket per environment?
• A project has kept state in a local terraform.tfstate file. The team adds a remote backend block and wants the existing state moved into it so nothing is recreated. Which command completes the change?
• A team edits its backend configuration to point at a new bucket whose state was already copied there by storage replication. They want terraform init to use the new settings and not attempt any state migration. Which command fits?
• A team uses the CLI-driven workflow with HCP Terraform. Their workspaces app-dev, app-staging and app-prod all carry the tag app. Developers want one configuration that lets them switch among those workspaces with terraform workspace select. How should the configuration connect?
• An application team reads the network team's VPC ID with the terraformremotestate data source. The network team's state also contains database passwords managed by other resources. What should the network team understand about this access?
• In HCP Terraform, a consuming workspace needs a producing workspace's outputs. The producing team will not grant access to its full state and wants the shared values to stay current automatically after each apply. Which approach fits?
• Two pipeline jobs for the same environment start terraform apply within seconds of each other. Both use an S3 backend configured with uselockfile = true, and neither passes -lock=false. What happens to the job that starts second?
• A CI runner was killed mid-apply, and every later run for that workspace now fails with an error that the state is locked, showing a lock ID and the dead runner as the holder. What should the engineer do?
• An operator suspects someone edited a security group's rules in the cloud console. The team wants to see exactly how the real object differs from what Terraform last recorded, without changing any infrastructure and without updating the state yet. Which command fits?
• A refresh-only plan shows that an ingress rule allowing 0.0.0.0/0 was added to a production security group outside Terraform. The change was unauthorized, and the Terraform configuration is still correct. Which action restores the approved rule set?
• A teammate renamed resource "awss3bucket" "logs" to resource "awss3bucket" "auditlogs" during a cleanup, and the plan now shows the bucket being destroyed and a new one created. The bucket holds data that must be kept. What is the reviewable fix?
• A team is handing an existing load balancer over to a separate networking team that manages it with its own tooling. The load balancer must keep running, but this configuration should stop managing it, and the change must go through the normal plan review in a pull request. What should they do?
• One instance in a foreach set, awsinstance.worker["b"], has a corrupted boot disk. Its configuration is fine, so a normal plan shows no changes. The team wants to rebuild just that instance through a reviewable plan. Which approach is current practice?
• An engineer pulled a workspace's state from HCP Terraform, hand-edited the JSON, and pushed it back with terraform state push -force. Runs now fail with state errors. The previous state version is known to be good. What is the safest recovery?
• A platform team is splitting one large configuration into separate network and compute configurations, each with its own HCP Terraform workspace. The subnets must move from the old state to the new network state without being recreated, through reviewed plans. Which approach fits?
• HCP Terraform health assessments report drift on a workspace: someone enabled versioning on a storage bucket in the console. After review, the team decides the change is correct and should become the new standard. How should they resolve the drift?
• A resource sets lifecycle { ignorechanges = [tags] } because an external cost tool rewrites tags. A refresh-only plan still reports the tags as changed outside of Terraform. An engineer thinks ignorechanges is broken. What explains the behavior?
• Before raising the AzureRM provider to a new major version, a lead wants a list showing which modules in the configuration, including nested child modules, declare a requirement on that provider and with what version constraints. Which command shows this?
• A base network module is about to be upgraded, and the team wants a picture of which resources in the configuration depend on its resources, whether through attribute references or dependson, to judge the blast radius. Which approach gives that view?
• A root module declares dependson = [module.network] on a module that contains several data sources. Since then, plans show many of that module's data source results as known after apply and propose more changes than expected. What is the recommended fix?
• A network workspace in HCP Terraform publishes an output named vpcid. Several application workspaces read it through tfeoutputs and are linked by run triggers. A developer wants to rename the output to networkvpcid. What is the main risk, and how should it be handled?
• A root configuration declares requiredversion = "~> 1.10.0" and runs on Terraform 1.10.5. The team bumps a registry module to a release whose own terraform block declares requiredversion = ">= 1.11". What happens, and what must change?
• A provider major upgrade removes an argument from the awsinstance resource type and changes its defaults. Before merging the upgrade, the team wants to know exactly which managed instances in this workspace would be affected and how. Which approach scopes the impact?
• In HCP Terraform, a network workspace feeds a platform workspace, which feeds an application workspace. The team wants each downstream workspace to queue a run automatically after its upstream workspace applies successfully. How should this be configured?
• Developers on macOS committed a dependency lock file after a provider upgrade. Linux CI runners now fail during terraform init, reporting that the provider package checksum doesn't match any checksum recorded in the lock file. What fixes this properly?
• An organization runs Terraform 1.9 in dev, stage, and prod, each with its own state. The lead wants to move all three to Terraform 1.15 while limiting risk. Which rollout plan is appropriate?
• Production was upgraded from Terraform 1.14 to 1.15 and has had several successful applies since. An engineer now wants to switch prod's pipeline back to 1.14 because a colleague prefers its plan output. What should the team understand first?
• A CI image installs the latest Terraform release whenever it is rebuilt, and a new minor version recently changed plan behavior without warning. The team wants upgrades to happen only deliberately and wants engineers' laptops held to the same rule. What should they do?
• An engineer changes a provider constraint from "~> 5.40" to "~> 5.60" and runs terraform init, which reports that the locked 5.45 does not match the new constraint. What does running terraform init -upgrade do here?
• After a team moves CI from Terraform 1.14 to 1.15, terraform validate starts failing on a backend "s3" block whose required bucket argument was misspelled as buckets. The same file validated cleanly on 1.14. What is the right response?
• A pipeline using the S3 backend sets AWSUSEFIPSENDPOINT=1 so state traffic goes to FIPS endpoints. After an upgrade to Terraform 1.15, the backend no longer uses the FIPS endpoint. Which change restores the intended behavior?
• A platform team maintains a shared module whose input instancesize is being replaced by instancetype. All callers now run Terraform 1.15. The team wants callers who still pass instancesize to see a warning naming the replacement, without their runs failing. What should the team add?
• A team is about to move a production workspace from Terraform 1.14 to 1.15 and wants evidence that the new core version alone will not change infrastructure. Configuration and provider versions stay the same. What is the most useful test before applying anything with 1.15?
• A configuration calls module "network", which itself calls a nested subnets module. An engineer needs a quick list of every resource instance in state that belongs to module.network, including the nested module's resources. Which command produces that list?
• During an incident, an engineer needs every attribute Terraform has recorded for one foreach instance, awsinstance.web["api"], including its provider-assigned ID, printed in human-readable form. Which command should they run?
• A deployment script needs the value of the string output lbdnsname with no quotes or extra formatting so it can pass it to curl. Another pipeline stage needs all root outputs, including a map, in a stable machine-readable format. Which commands fit each need?
• A compliance team's audit tool needs to ingest the full current state of a workspace, with resource types, addresses and attribute values, in the stable machine-readable format Terraform documents for external tools. Which command should the pipeline run?
• A database password variable and its output are both marked sensitive = true, and plans and terraform output now display (sensitive). A security reviewer asks whether this means the password is no longer stored in the workspace state. What is the accurate answer?
• A configuration uses an ephemeral randompassword block and passes its result to a resource's write-only password argument. After apply, an engineer runs terraform state list and terraform show and finds no entry for the ephemeral block, and wonders whether state is broken. What explains this?
• An engineer wants to examine a remote workspace's state offline with jq while investigating an issue, without risking changes to the shared state. Which approach is appropriate?
• While debugging, an engineer wants to check the current value of awsvpc.main.cidrblock and test what cidrsubnet(awsvpc.main.cidrblock, 8, 2) returns, using the values already in state and without editing configuration or running a plan. Which tool fits?
• Resources in an HCP Terraform workspace changed unexpectedly last week. An engineer wants to see when each state change happened, which run and VCS commit produced it, and what changed between versions. Where should they look?