40 Terraform & IaC interview questions with answers

All Terraform & IaC interview questions

• What does IaC give you over clicking in the cloud console?

• What does Terraform state contain and why must it not be committed to Git?

• Which lines of `terraform plan` output deserve the most attention?

• What is a provider? Does Terraform make infrastructure portable between AWS and GCP?

• What is variable precedence, and how should secrets be passed?

• What is the difference between a `resource` and a `data` block, and when do you use `data`?

• What does `terraform init` do, and should `.terraform.lock.hcl` be committed?

• How does Terraform decide creation order, and when do you need `depends_on`?

• What does a production remote backend need, and what does state locking solve?

• Someone edited the console by hand. How does Terraform react and how do you prevent it?

• Does splitting code into modules reduce blast radius?

• Why prefer `for_each` over `count` when creating multiple resources?

• What are the steps to bring a hand-created EC2 instance under Terraform?

• How do you rename a resource or wrap it in a module without recreating it?

• Separating staging and production: workspaces or separate directories?

• Does `sensitive = true` protect a secret?

• What steps belong in a Terraform pipeline?

• How do you stop a production RDS instance being deleted through Terraform?

• Why is the `remote-exec` provisioner considered a last resort?

• How do you create resources in two regions or accounts within one configuration?

• Where should testing Terraform code start?

• Who should be allowed to run `terraform apply` against production?

• How do you replace a serving resource without downtime?

• What is policy as code (Sentinel, OPA/Conftest) for in a Terraform pipeline?

• Why should all company infrastructure not live in one state?

• How does IaC help control cloud cost?

• Why does tagging every resource matter, and how do you apply tags consistently?

• An apply fails midway because of a provider API error. What state are you in?

• How should a company-wide shared module be referenced and released?

• What does an ephemeral environment per pull request require?

• The state file is lost entirely. What happens and how do you recover?

• `terraform plan` now takes 15 minutes. What is the root fix?

• How should drift detection work at scale, and how is drift classified?

• How do you upgrade Terraform to a new major version across dozens of states?

• What role does IaC play in a disaster recovery plan?

• Why do RDS and S3 need different handling from EC2 and ASGs?

• How do you take over a fully hand-built production system with Terraform?

• What should not be managed by Terraform?

• What do you look at to judge whether an IaC project is healthy?

• What most commonly causes IaC adoption to fail?