25 Advanced Terraform Interview Questions for Senior Roles

Candidate Reply: Securing the state file is super important because it contains sensitive info like resource IDs or passwords. I use a remote backend like AWS S3 with encryption enabled and lock it with DynamoDB to prevent conflicts. I also restrict access using IAM policies so only specific users can read or write to it. For extra security, I enable versioning in S3 to recover from accidental deletes.

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

Candidate Reply: State file conflicts happen when multiple people try to change the same infrastructure. I use a remote backend with state locking, like S3 with DynamoDB. When someone runs terraform apply, DynamoDB locks the state file so others can’t mess it up. I also set up CI/CD pipelines to run Terraform sequentially, so changes don’t overlap.

Candidate Reply: Drift happens when the actual infrastructure doesn’t match the Terraform code, like if someone manually changes a resource. I run terraform plan to detect drift—it shows what’s different. To fix it, I either update the Terraform code to match the real state or run terraform apply to bring the infrastructure back in line. For big teams, I use tools like Terraform Cloud to monitor drift automatically.

Candidate Reply: I organize modules like mini-projects, each handling one piece of infrastructure, like a VPC or an EC2 instance. I keep them generic with variables for customization, like region or instance type. I also use a clear folder structure—root module for the main config and submodules in a modules/ folder. This makes them easy to reuse across projects.

# modules/vpc/main.tf
variable "vpc_cidr" {
  default = "10.0.0.0/16"
}
resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
}

Candidate Reply: For zero-downtime, I use strategies like blue-green deployments. In Terraform, I create a new set of resources, like a new auto-scaling group, and update the load balancer to point to it. Once it’s stable, I destroy the old resources. I use create_before_destroy in Terraform to make sure the new stuff is ready first.

lifecycle {
  create_before_destroy = true
}

Candidate Reply: I use workspaces or separate state files for each environment. For example, I create a folder structure like `environments/dev`, `environments/staging`, and `environments/prod`, each with its own `terraform.tfvars` file for environment-specific settings. I also use modules to share code across environments, so I don’t repeat myself.

# environments/dev/terraform.tfvars
instance_type = "t2.micro"

Candidate Reply: I store modules in a Git repo and use tags for versioning, like `v1.0.0`. For teams, I publish modules to a registry like Terraform Cloud or a private GitHub repo. In the code, I specify the version to avoid breaking changes, like `source = “git::https://github.com/my-org/vpc-module?ref=v1.0.0″`.

Candidate Reply: I set up Terraform in a CI/CD tool like GitHub Actions or Jenkins. The pipeline runs terraform init, terraform plan, and terraform apply automatically when code is pushed. I use a plan file to review changes before applying and store the state file in a secure backend. I also add approval steps for production changes.

# GitHub Actions example
name: Terraform Apply
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
      - run: terraform init
      - run: terraform plan -out=tfplan
      - run: terraform apply tfplan

Candidate Reply: I never store secrets in Terraform code. Instead, I use a secrets manager like AWS Secrets Manager or HashiCorp Vault. In Terraform, I fetch secrets dynamically using data sources. For example, I pull a database password from Secrets Manager and pass it to a resource.

data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "my-db-password"
}

Candidate Reply: terraform taint marks a resource as “broken” so Terraform recreates it on the next apply. It’s useful for forcing a refresh. terraform replace (newer in Terraform 1.0) directly tells Terraform to replace a specific resource. Replace is cleaner because it’s explicit, while taint is more of a legacy command.

Candidate Reply: If a provider errors, I first check the error message from terraform apply. I enable debug logging with TF_LOG=DEBUG and run it again to get detailed logs. I also verify the provider version and check the provider’s documentation or GitHub issues. If it’s a config issue, I test with a smaller setup to isolate the problem.

Candidate Reply: To migrate a state file, I update the Terraform code to point to the new backend, like from local to S3. Then, I run terraform init, and Terraform asks if I want to copy the state file. I say yes, and it moves the state without downtime. I always back up the state file first!

Candidate Reply: for_each lets you create multiple resources from a map or set. For example, if I need multiple EC2 instances, I define a map of instances and use for_each to loop through it. It’s cleaner than count because it ties resources to keys.

variable "instances" {
  type = map
  default = {
    "web1" = { size = "t2.micro" }
    "web2" = { size = "t2.small" }
    "web3" = { size = "t3.large" }
  }
}
resource "aws_instance" "web" {
  for_each = var.instances
  ami           = "ami-12345678"
  instance_type = each.value.size
}

Candidate Reply: Terraform automatically figures out dependencies based on references, like using a VPC ID in a subnet resource. If I need to be explicit, I use depends_on. For example, I make sure a database is created before an app server that needs it.

resource "aws_db_instance" "db" {
  # DB config
}
resource "aws_instance" "app" {
  depends_on = [aws_db_instance.db]
  # App config
}

Candidate Reply: A provisioner runs scripts or commands on a resource after it’s created, like installing software on a server. I use them sparingly, like for initial setup, because tools like Ansible are better for configuration. For example, I might use a remote-exec provisioner to run a bash script.

provisioner "remote-exec" {
  inline = ["sudo apt update", "sudo apt install nginx"]
}

Candidate Reply: I use tools like `terratest` to write automated tests in Go. For example, I write a test to deploy a VPC, check if it exists, and then destroy it. I also run terraform plan in CI to catch syntax errors and use terraform fmt to enforce code style.

Candidate Reply: I break the config into modules for each component, like networking or compute. I move resources to modules one at a time, using terraform state mv to update the state file without recreating resources. I test each change with terraform plan to ensure no disruptions.

Candidate Reply: For big deployments, I split the infrastructure into smaller Terraform projects, like one for networking and one for apps. I use remote state to share data between them, like a VPC ID. I also use Terraform Cloud for collaboration and run applies in parallel where possible to speed things up.

Candidate Reply: terraform import brings existing resources into Terraform’s state file. For example, if someone manually created an EC2 instance, I write a resource block for it and run terraform import to manage it with Terraform. It’s handy for adopting legacy infrastructure.

terraform import aws_instance.web i-1234567890abcdef0

Candidate Reply: To speed up Terraform, I reduce the number of resources in a single apply by splitting configs into smaller projects. I use targeted applies with terraform apply -target=resource_name for quick changes. I also cache providers with terraform init -get-plugins=false in CI/CD.

Candidate Reply: I use the Kubernetes provider to manage resources like pods or services. For example, I define a deployment in Terraform and apply it to a cluster. I set up the provider with the cluster’s endpoint and credentials, often pulled from an EKS cluster.

provider "kubernetes" {
  host                   = aws_eks_cluster.my_cluster.endpoint
  cluster_ca_certificate = base64decode(aws_eks_cluster.my_cluster.certificate_authority[0].data)
}

Candidate Reply: Upgrading Terraform needs care to avoid breaking configs. I check the changelog for the new version and run terraform 0.12upgrade or 0.13upgrade for major updates. I test the upgrade in a dev environment first, then update provider versions and re-run terraform init.

Candidate Reply: A data source fetches info from existing resources without managing them. For example, I use the `aws_ami` data source to get the latest Ubuntu AMI ID for an EC2 instance. It’s great for dynamic configs.

data "aws_ami" "ubuntu" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }
}

Candidate Reply: I use tools like Sentinel in Terraform Cloud to enforce policies, like requiring specific tags on resources. I also set up code reviews in CI/CD and use IAM roles to limit who can apply changes. For example, only senior engineers can touch production.

Candidate Reply: If `terraform apply` fails, I check the error message to understand the issue. I use `terraform state list` to see affected resources and `terraform state rm` to remove broken ones if needed. I fix the config, run `terraform plan` to confirm, and re-apply. I always keep state backups to avoid data loss.