Comprehensive guide for Cloud / DevOps interviews (3–10 years). Kept original numbering and organized into Beginner → Intermediate → Advanced → Scenario → Modules → Troubleshooting → Terragrunt sections — blog-ready and SEO-friendly.
Table of Contents
- Basic Terraform Interview Questions (Q1–Q5)
- Intermediate Terraform Questions (Q6–Q14)
- Advanced Terraform Questions (Q15–Q25)
- Curated 25 Questions (4-year experience flavor)
- Advanced / Experienced Interview Questions (1–30)
- Scenario-Based Interview Questions & Answers
- Real-Time Scenarios & Hands-On Examples
- Terraform Enterprise Features & Use Cases
- Terraform Modules Interview Questions & Answers
- Troubleshooting & Best Practices (AWS + Azure)
- Terragrunt: Use Cases, Scenarios, and Interview Questions
🟢 Basic Terraform Interview Questions
- What is Terraform?
Answer:
Terraform is an open-source Infrastructure-as-Code (IaC) tool by HashiCorp used to provision, manage, and version cloud infrastructure using declarative configuration files. It supports multiple providers like AWS, Azure, GCP, VMware, and more.
- What are the key components of Terraform?
Answer:
- Providers – Define which cloud/service APIs to interact with (e.g., AWS, Azure).
- Resources – The actual infrastructure components (e.g., EC2 instance, VNet).
- Modules – Reusable collections of Terraform configurations.
- State File – Tracks the current infrastructure status (terraform.tfstate).
- Variables & Outputs – Parameterize configurations and share results.
- Backend – Defines where the Terraform state file is stored (local, S3, etc.).
- What language is Terraform written in and what is HCL?
Answer:
Terraform is written in Go. It uses HCL (HashiCorp Configuration Language) — a human-readable declarative language designed for infrastructure automation.
- What is the difference between
terraform planandterraform apply?
Answer:
terraform plan: Shows the changes Terraform will make without applying them.terraform apply: Executes those changes and provisions/updates resources.
- What is a Terraform provider?
Answer:
A provider is a plugin that enables Terraform to interact with APIs of cloud providers or services (e.g., aws, azurerm, google, kubernetes, etc.).
🟡 Intermediate Terraform Questions
- What is the Terraform state file? Why is it important?
Answer:
The state file (terraform.tfstate) keeps track of the current infrastructure deployed by Terraform. It maps your configuration to real-world resources, allowing Terraform to:
- Detect drift (changes outside Terraform).
- Plan accurate updates.
- Enable collaboration when stored remotely.
- What are remote backends in Terraform?
Answer:
Remote backends store the Terraform state file in a centralized, shared location (e.g., AWS S3, Azure Blob, Terraform Cloud). They improve collaboration, enable state locking, and prevent data loss.
- How do you handle secrets in Terraform?
Answer:
- Use environment variables instead of hardcoding secrets.
- Use Terraform Cloud or Vault for secret management.
- Integrate with AWS Secrets Manager or Azure Key Vault.
- Avoid committing
.tfstatefiles with sensitive data to Git.
- What are Terraform modules?
Answer:
Modules are reusable Terraform configurations — they help reduce code duplication and standardize infrastructure setup.
Example:
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
cidr_block = "10.0.0.0/16"
}
- What is the difference between
terraform importandterraform statecommands?
Answer:
terraform import: Brings existing resources under Terraform management.terraform state: Manages or inspects state files (e.g., remove, list, show resources).
- What is the purpose of the
.terraform.lock.hclfile?
Answer:
It locks provider versions used in the configuration to ensure consistent builds across environments.
- Explain Terraform lifecycle meta-arguments.
Answer:
Used to control resource creation, updates, and destruction:
lifecycle {
create_before_destroy = true
prevent_destroy = true
ignore_changes = [tags]
}
- What is the difference between
countandfor_eachin Terraform?
Answer:
count: Creates multiple resources based on index (integer-based).for_each: Creates multiple resources based on keys (map/set-based).
Example:
resource "aws_instance" "web" {
for_each = toset(["dev", "test", "prod"])
tags = { Name = each.key }
}
- What is Terraform Drift?
Answer:
Drift occurs when infrastructure is changed outside Terraform (e.g., manual console updates), making the actual state different from the .tfstate.
🔵 Advanced Terraform Questions
- How do you manage multiple environments (dev/stage/prod)?
Answer:
- Use workspaces:
terraform workspace new dev - Use separate directories or state files.
- Use variable files (
dev.tfvars,prod.tfvars).
- How can you integrate Terraform with CI/CD pipelines?
Answer:
Use tools like Jenkins, GitHub Actions, or Azure DevOps to run terraform fmt, terraform validate, terraform plan, and terraform apply. Use remote backends and service principals for authentication.
- What are Terraform provisioners and when should they be used?
Answer:
Provisioners (e.g., remote-exec, local-exec) run scripts or commands on resources after creation. They should be used sparingly, as they break declarative design principles.
- How do you perform a Terraform destroy for only one resource?
Answer:
terraform destroy -target=aws_instance.web
- How does
depends_onwork in Terraform?
Answer:
It defines an explicit dependency between resources to ensure correct creation order.
Example:
resource "aws_instance" "app" {
depends_on = [aws_security_group.app_sg]
}
- Explain Terraform Cloud and Terraform Enterprise.
Answer:
- Terraform Cloud: Managed SaaS by HashiCorp for remote runs, version control, and team collaboration.
- Terraform Enterprise: Self-hosted version for organizations needing governance, policy checks, and private modules.
- What is a Terraform workspace?
Answer:
Workspaces allow multiple state files within the same configuration — useful for managing multiple environments (e.g., default, dev, prod).
- How do you upgrade provider versions in Terraform?
Answer:
Update the required_providers block and run:
terraform init -upgrade
Example:
terraform {
required_providers {
aws = { version = "~> 5.0" }
}
}
- How do you debug Terraform issues?
Answer:
- Run with debug flag:
TF_LOG=DEBUG terraform apply - Check plan and state for mismatches.
- Use
terraform refreshorterraform state list.
- What are some common Terraform best practices?
Answer:
- Use version control (Git).
- Store state remotely and enable locking.
- Use modules and variables.
- Run
terraform fmtandterraform validate. - Implement CI/CD validation stages.
- What is the difference between
local-execandremote-execprovisioners?
Answer:
local-exec: Executes a command on the machine running Terraform.remote-exec: Executes a command inside the target resource (e.g., EC2 instance via SSH).
Curated — 25 Terraform interview questions (4-year DevOps experience flavor)
Concise, experience-focused answers grouped by difficulty to help mid-level candidates prepare for real-world interview scenarios.
Beginner / Fundamentals (Q1–Q6)
- What is Terraform and how does it differ from other IaC tools?
Answer: Terraform is an immutable, declarative IaC tool that uses HCL to define infrastructure in code. Unlike Ansible/Chef (configuration management), it creates/destroys resources via providers. Key differences: state management, plan/apply workflow, multi-cloud support.
- Explain the Terraform workflow.
Answer: terraform init → terraform plan → terraform apply → terraform destroy.
- What is Terraform state? Why is it important?
Answer: JSON file (terraform.tfstate) mapping resources to real IDs. Enables incremental changes, collaboration, and drift detection. Never commit to VCS without remote backend + locking.
- What are remote backends? Name a few.
Answer: Store state in shared, lockable storage: S3 + DynamoDB, Terraform Cloud, Azure RM, GCS, Consul.
- What is a provider? Give examples.
Answer: Plugin that interacts with APIs. Examples: aws, azurerm, google, kubernetes, vault.
- Explain
terraform fmt,validate,taint,import.
Answer:
fmt→ canonical HCL stylevalidate→ syntax + schema checktaint→ mark resource for recreation (deprecated; use-replacein v1+)import→ bring existing infra under TF management
Intermediate (Q7–Q15)
- How do you manage secrets in Terraform?
Answer: Use sensitive = true, Vault, Secrets Manager, env variables (TF_VAR_), Terraform Cloud encrypted variables.
- What are modules? When would you create one?
Answer: Reusable, versioned directories with inputs/outputs — create for VPC, ECS, RDS, etc.
- Explain
count,for_each, anddepends_on.
Answer:
count→ N identical resourcesfor_each→ iterate over maps/setsdepends_on→ explicit dependency
- What is a
datasource? Give an example.
Answer: Reads existing resources without managing them (e.g., data "aws_ami" "latest" { ... }).
- How do you handle drift detection?
Answer: Run terraform plan in CI; terraform refresh to update state; use Terraform Cloud/Atlantis for drift checks.
- What is
terraform workspace? When to use vs. directories?
Answer: Isolated state per workspace — good for simple envs; prefer directory-per-env for complex configs.
- Explain
null_resourceand a use-case.
Answer: Executes scripts when no native resource exists; use for DB seeding or orchestration with triggers.
- What are provisioners? When should you avoid them?
Answer: local-exec/remote-exec—use sparingly; prefer cloud-init or native resource support.
- How do you version Terraform configurations?
Answer: Use Git tags and semantic versioning in module source references.
Advanced / Scenario-Based (Q16–Q25)
- Design a multi-account AWS landing zone with Terraform.
Answer (high level): Root module for Organizations, per-account modules via for_each, remote state per account, assume-role provider aliases.
- How to implement blue/green zero-downtime?
Answer: Use AWS CodeDeploy or ECS, manage two target groups, create_before_destroy, Route53 weighted DNS or ALB target switching.
- Explain Terraform state locking and DynamoDB.
Answer: Prevent concurrent apply. DynamoDB table stores a lock item; used with S3 backend.
- What is
terraform graph?
Answer: Outputs DOT dependency graph for visualization and circular dependency detection.
- Handling partial state with
state mv/rm.
Answer: mv to rename addresses after refactor; rm to remove from state (dangerous)—always backup.
- Module supporting AWS and Azure with same interface?
Answer: Use provider aliases and conditional count to enable the desired provider.
- Integrate Terraform with GitHub Actions (example).
Answer: Setup job to run init, plan -out, store plan, manual approval stage, apply plan. Add tfsec/infracost for checks.
terraform refreshvsapply -refresh-only.
Answer: refresh updates state only. apply -refresh-only creates a plan to sync state and requires apply to change infra.
- Terraform Cloud/Enterprise features used in production.
Answer: Remote execution, VCS workflows, Sentinel, private registry, cost estimation, SSO.
- How to perform canary deployments with Terraform?
Answer: Two ASGs or ECS services, weighted routing, create_before_destroy, and CI-driven traffic shift.
Quick Revision Cheat-Sheet (4-yr DevOps)
# versions.tf
terraform {
required_version = ">= 1.6.0"
required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }
backend "s3" { bucket = "my-tf-state", key = "prod.tfstate", dynamodb_table = "lock" }
}
# variables.tf (sensitive)
variable "db_password" { type = string, sensitive = true }
# main.tf
provider "aws" { reg
