Terraform Interview Questions

1. What is Terraform and what problem does infrastructure as code solve?

2. What is the difference between Terraform and configuration tools like Ansible?

3. What is declarative vs imperative infrastructure and where does Terraform fit?

4. What is the Terraform state file and why is it important?

5. Why should you use remote state in Terraform and how does a backend work?

6. What is state locking in Terraform and why does it matter?

7. What is the Terraform workflow with init, plan, and apply?

8. What does terraform plan do and why is it important before apply?

9. What are providers in Terraform and how do they work?

10. What are resources and data sources in Terraform?

11. What are input variables, output values, and locals in Terraform?

12. What are Terraform modules and why do you use them?

13. What is the difference between a root module and a child module in Terraform?

14. How does Terraform handle dependencies between resources?

15. What is the difference between count and for_each in Terraform?

16. What are provisioners in Terraform and why are they a last resort?

17. What is terraform import and when do you use it?

18. What is the difference between terraform taint and terraform replace?

19. How do Terraform workspaces work and when should you use them?

20. What is drift in Terraform and how do you detect and fix it?

21. How do you manage secrets and sensitive values in Terraform?

22. What is the difference between terraform refresh and terraform plan?

23. How does Terraform handle resource lifecycle with create_before_destroy and prevent_destroy?

24. What are dynamic blocks in Terraform and when are they useful?

25. How do you structure Terraform code for multiple environments?

26. What is a Terraform backend and what are the common backend types?

27. How does terraform destroy work and how do you prevent accidental destruction?

28. What is the difference between Terraform and CloudFormation?

29. What are common Terraform best practices for team collaboration?

30. How do you test and validate Terraform code?

31. How do you refactor Terraform code without destroying and recreating resources?

32. How do you debug a Terraform run that fails inside a provider?

33. What does .terraform.lock.hcl do and how do you manage provider checksums across platforms?

34. How do you enforce guardrails on Terraform changes with policy as code?

35. A single Terraform state has grown huge and plans are slow. How do you split it, and why is -target a last resort?

36. How do you use variable validation, preconditions, postconditions and check blocks in Terraform?

37. Why does Terraform say a value "will be known only after apply", and how do you work with unknown values?

38. How do you safely upgrade a Terraform provider across a breaking major version?

39. How do you run Terraform in CI/CD without storing long-lived cloud credentials?

40. How do you debug complex HCL expressions, and when do you use try, can and type conversion functions?

41. The provider has no resource for what you need. What are your options and their trade-offs?

42. Your Terraform state is corrupted, lost, or no longer matches reality. How do you recover?

43. A Terraform run was killed mid-apply and now every plan fails with a state lock error. What do you do?

44. What is the difference between an import block and the terraform import command?

45. How would you build continuous drift detection for Terraform, and what does a refresh-only plan actually do?

46. Why can removing one item from a Terraform list destroy several resources, and how do stable for_each keys prevent it?

47. How do you version and pin Terraform modules, and why does a Git branch source cause trouble?

48. How do you manage resources in two regions or two accounts from one Terraform configuration?

49. Why should a reusable module declare configuration_aliases instead of its own provider block?

50. When does Terraform actually read a data source, and why does that sometimes break a plan?

51. When is lifecycle ignore_changes the right answer, and when is it hiding a real problem?

52. What does replace_triggered_by do, and how is it different from tainting a resource?

53. Does marking a variable sensitive keep it out of the state file? What actually protects secrets in Terraform?

54. Why do many teams avoid CLI workspaces for production and staging, and what do they use instead?

55. How do you make Terraform plan review in a pull request actually trustworthy?

56. How do you debug why Terraform is creating resources in an unexpected order?

57. Terraform reports a cycle error. How do you find it and break it?

58. What does terraform state rm actually do, and when does it create an orphan you regret?

59. How do you move Terraform state from one backend to another without losing anything?

60. A terraform plan takes twenty minutes. How do you diagnose and fix it?

61. Terraform shows the same change on every plan even straight after an apply. How do you diagnose it?