Terraform Interview Questions
22 questions
Terraform interview questions on provider versioning and the dependency lock file, workspaces versus separate state files, state management (drift, locking, splitting monoliths, sensitive data, backup/recovery), and module design — the kind of state-file and provider-behavior subtleties that only show up after running Terraform against real, shared infrastructure.
What would make you choose a private Terraform module registry over Git-tag-based module sourcing, or vice versa?
IntermediateTerraform6 min
How would you structure a shared Terraform module differently if its consuming repos were owned by teams with different release cadences and risk tolerances?
AdvancedTerraform7 min
How would you handle a breaking change to a shared Terraform module that genuinely needs to reach all consumers within a specific timeframe, like a security fix?
AdvancedTerraform7 min
Your team has copy-pasted the same VPC Terraform configuration into six different repositories. Design a module structure and versioning strategy to fix that.
IntermediateTerraform10 min
terraform plan shows changes to a resource you didn't touch, and the diff traces back to a data source — what's actually happening?
AdvancedTerraform7 min
Converting a resource block from count to for_each caused Terraform to want to destroy and recreate every instance — why, and how do you migrate safely?
AdvancedTerraform7 min
A production database was created manually through the AWS console years ago — how would you bring it under Terraform management without recreating it?
IntermediateTerraform7 min
terraform init fails with a provider checksum mismatch after a teammate on a different OS committed the lock file — what's happening?
IntermediateTerraform6 min
How would you deploy the same Terraform resource type to multiple AWS regions within a single configuration, using provider aliases?
IntermediateTerraform6 min
Should you use Terraform workspaces or separate directories/state files to manage dev, staging, and production — what's the actual trade-off?
IntermediateTerraform7 min
How would you make it structurally difficult for someone to accidentally run terraform destroy against a production state?
IntermediateTerraform6 min
terraform plan fails with Error acquiring the state lock — how do you diagnose whether it's a genuine concurrent run or a stale lock?
IntermediateTerraform6 min
A Terraform pipeline that worked yesterday suddenly fails today with no code changes — how does an unpinned provider version cause this?
IntermediateTerraform6 min
A corrupted or accidentally-overwritten Terraform state file threatens to make you lose track of an entire environment's real infrastructure — how would you design for recoverability?
AdvancedTerraform7 min
How would you design a CI/CD pipeline to automatically block a Terraform apply that would destroy a production database?
AdvancedTerraform8 min
How does Terraform's create_before_destroy interact with resources that have unique naming constraints, like a fixed identifier?
AdvancedTerraform7 min
What's the difference between state drift and a genuine configuration change in Terraform, and how does -refresh-only help distinguish them?
IntermediateTerraform6 min
A single Terraform state file managing an entire environment's infrastructure takes 10 minutes to plan and any change risks touching everything — how would you split it?
AdvancedTerraform8 min
Using terraform_remote_state to reference another team's outputs works, but creates a tight coupling that breaks when they change their state — what's the alternative?
AdvancedTerraform7 min
What's the difference between terraform state rm and just deleting a resource block from configuration — when would you use state rm specifically?
IntermediateTerraform6 min
A database password is passed as a resource argument in Terraform — does marking the variable sensitive actually protect it in the state file?
AdvancedTerraform7 min
terraform plan shows a production RDS instance will be destroyed and recreated after a change you thought was trivial. What would you investigate before running apply?
AdvancedTerraformAWS10 min