Top 50 Terraform + AWS Interview Questions and Answers (2025 Edition)
Section 1: Terraform Basics
1. What is Terraform?
Terraform is an open-source Infrastructure-as-Code (IaC) tool by HashiCorp that allows users to define infrastructure using declarative configuration files.
2. Why use Terraform with AWS?
Terraform enables repeatable, version-controlled provisioning of AWS resources, supporting automation and team collaboration.
3. What language does Terraform use?
Terraform uses HCL (HashiCorp Configuration Language), which is declarative and JSON-compatible.
4. List core Terraform commands.
init, plan, apply, destroy, validate, import, taint, untaint, state, output.
5. What is the Terraform state file?
The state file tracks infrastructure resources mapped to configuration. It's essential for planning, updates, and detecting drift.
Section 2: Terraform Components
6. What is a provider in Terraform?
A provider is a plugin that defines how Terraform interacts with APIs, like AWS, GCP, Azure, etc.
7. What are resources?
Resources represent components of your infrastructure, such as EC2 instances, S3 buckets, etc.
8. What are variables?
Variables allow dynamic configuration values to be passed into modules or files, improving flexibility and reusability.
9. What are outputs?
Outputs return information from your infrastructure, such as IP addresses or resource IDs, after execution.
10. What is a module?
A module is a container for multiple resources that can be reused throughout configurations or across projects.
Section 3: Advanced Terraform Usage
11. What are workspaces?
Workspaces allow multiple state environments (like dev, staging, prod) using the same configuration.
12. What is remote state?
Remote state stores Terraform state in a shared location like S3 to enable team collaboration and prevent conflicts.
13. What is backend configuration?
Backends define how state is loaded and where it’s stored, such as local, S3, Terraform Cloud, etc.
14. How do you import existing resources into Terraform?
Use terraform import
followed by the resource type and ID to include existing infrastructure.
15. When should you use provisioners?
Provisioners are used to execute scripts on resources. They should be avoided if possible due to their imperative nature.
Section 4: AWS-Specific Questions
16. How does Terraform provision AWS VPC?
Use the aws_vpc
resource with CIDR block, tags, and optionally aws_subnet
and aws_internet_gateway
.
17. How do you manage IAM roles and policies?
Use aws_iam_role
, aws_iam_policy
, and aws_iam_role_policy_attachment
to define and attach permissions.
18. How do you handle secrets in Terraform?
Avoid hardcoding. Use environment variables, AWS Secrets Manager, Parameter Store, or Vault.
19. How can Terraform create and manage RDS instances?
Use aws_db_instance
with aws_db_subnet_group
, defining instance type, storage, and backups.
20. How do you deploy EC2 using Terraform?
Use aws_instance
resource with AMI ID, instance type, key name, security group, and subnet references.
Section 5: Terraform State, Dependencies, and Lifecycle
21. What is Terraform's lifecycle?
Terraform follows a lifecycle of Init → Plan → Apply → Destroy. This ensures predictable, idempotent changes to infrastructure.
22. What is the purpose of the `terraform plan` command?
It shows what Terraform will do before it does it, allowing users to review changes before applying them.
23. What are implicit vs. explicit dependencies?
Implicit dependencies are created via variable references; explicit dependencies use depends_on
to force an order of execution.
24. What happens if your Terraform state file is lost?
Terraform loses track of managed resources. Rebuilding the state via `terraform import` or backups is required.
25. What is drift and how is it detected?
Drift is when real infrastructure differs from state. It's detected by running terraform plan
.
26. How can you lock Terraform state to avoid conflicts?
Use DynamoDB for state locking along with S3 backend to prevent concurrent operations.
27. What are data sources?
Data sources allow you to fetch external information (e.g., AMIs, VPC IDs) that you can use in configuration.
28. What is `terraform output` used for?
Displays output variables from a Terraform configuration, useful in CI/CD or for sharing values.
29. What does `terraform refresh` do?
It updates the state file with the real-time status of infrastructure but doesn't change the infra itself.
30. How do you manage different environments in Terraform?
Use separate workspaces, different variable files, or directory-based strategies (e.g., `dev/`, `prod/`).
Section 6: Resource Behavior and Management
31. What is a tainted resource?
A tainted resource will be destroyed and recreated on the next `terraform apply`.
32. How do you mark a resource for recreation?
Use terraform taint <resource_name>
.
33. How to rename a resource without destroying it?
Use terraform state mv
to move the state reference to a new name.
34. What happens when a resource is deleted manually?
Terraform will recreate the resource on the next `apply` unless the state is updated or adjusted.
35. What does the `lifecycle` block do?
Controls create-before-destroy, prevent_destroy, and ignore_changes behaviors.
36. How do you ignore changes to certain attributes?
Use `lifecycle { ignore_changes = [attribute] }` in the resource block.
37. How can you prevent Terraform from destroying a resource?
Use `lifecycle { prevent_destroy = true }`.
38. What does `create_before_destroy` do?
It ensures a new resource is created before the old one is destroyed—useful for zero-downtime updates.
39. What is count in Terraform?
A meta-argument to create multiple instances of a resource based on an integer value.
40. What is for_each in Terraform?
Allows iterating over a map or set of strings to create resources dynamically with more control than `count`.
Section 7: Terraform Cloud, CI/CD, and Best Practices
41. What is Terraform Cloud?
Terraform Cloud is a managed service offering remote state management, policy enforcement, and collaboration features.
42. What is Sentinel in Terraform?
Sentinel is a policy-as-code framework to enforce governance in Terraform Cloud or Enterprise.
43. What are some Terraform best practices?
Use modules, store state remotely, use version control, follow naming conventions, and avoid hardcoding values.
44. How do you structure Terraform code for teams?
Use modules, separate environments, remote backends, versioning, and shared input/output interfaces.
45. How to integrate Terraform with CI/CD pipelines?
Run `terraform init`, `plan`, and `apply` inside tools like GitHub Actions, GitLab CI, or Jenkins with version control triggers.
46. How do you validate a Terraform config?
Use terraform validate
to check syntax and structure.
47. What’s the difference between `terraform apply` and `terraform plan`?
`plan` previews changes; `apply` executes the changes in the infrastructure.
48. How do you roll back a Terraform change?
Restore from state backup or manually reverse config and reapply. There's no built-in rollback.
49. How do you upgrade a provider in Terraform?
Update the required provider version in the config and run terraform init -upgrade
.
50. What is a local value in Terraform?
Local values assign names to expressions to simplify and reuse them in a configuration using `locals {}` block.