Terraform is the de-facto standard for Infrastructure as Code (IaC), and it shows up in almost every cloud and DevOps interview. This 2026 guide groups the most common Terraform interview questions from fundamentals to advanced scenarios, with concise, accurate answers.
Terraform Fundamentals
What is Terraform and how is it different from other IaC tools?
Terraform is an open-source IaC tool by HashiCorp that lets you define infrastructure declaratively in HCL and provision it across many providers (AWS, Azure, GCP and more). Unlike configuration-management tools like Ansible (procedural, agent-optional, app-config focused), Terraform focuses on declarative provisioning and tracks resources in a state file. Unlike AWS CloudFormation, it is cloud-agnostic.
What is a provider?
A provider is a plugin that knows how to talk to a specific API (AWS, Azure, Kubernetes, etc.). You configure providers and Terraform uses them to create, read, update and delete resources.
What is the difference between a resource and a data source?
A resource block creates and manages infrastructure. A data source reads existing information (e.g., an existing VPC or AMI) without managing it.
Explain terraform init, plan and apply.
- init — initializes the working directory, downloads providers and configures the backend.
- plan — shows the execution plan (what will change) without making changes.
- apply — executes the plan to reach the desired state.
State Management
What is the Terraform state file and why does it matter?
The state file (terraform.tfstate) maps your configuration to real-world resources and tracks metadata. Terraform uses it to know what exists, detect drift, and plan changes. It can contain sensitive data, so it must be protected.
What is remote state and why use it?
Remote state stores the state file in a shared backend (e.g., an S3 bucket, Azure Storage, or Terraform Cloud) so a team can collaborate safely instead of passing a local file around.
How do you prevent two engineers from corrupting state at once?
Use state locking. With the S3 backend, a DynamoDB table provides locking; Terraform Cloud and most backends lock automatically during apply.
How do you bring existing infrastructure under Terraform?
Use terraform import to map an existing resource into state, then write matching configuration. Newer Terraform also supports import blocks for a plan-based workflow.
Modules and Reuse
What is a module and why use one?
A module is a reusable, parameterized group of resources. Modules reduce duplication, enforce standards, and let teams share patterns via the public or a private registry. Always pin module and provider versions for reproducibility.
Workflow and Day-2 Operations
What are workspaces?
Workspaces let you keep multiple state instances for the same configuration (e.g., dev/staging). For strong environment isolation, many teams prefer separate state/backends or directories over workspaces.
What is drift and how do you detect it?
Drift is when real infrastructure differs from state (e.g., a manual console change). terraform plan detects it; you then reconcile by applying or updating configuration.
What do terraform fmt and validate do?
fmt formats code to canonical style; validate checks syntax and internal consistency without contacting providers.
Advanced Terraform
count vs for_each — when do you use each?
Use count for identical, index-based copies; use for_each when iterating over a map or set so resources have stable keys (this avoids destroy/recreate when the list order changes).
What are dynamic blocks?
They generate repeatable nested blocks (like multiple ingress rules) from a collection, keeping configuration DRY.
What does the lifecycle block do?
It controls behaviour with arguments like create_before_destroy, prevent_destroy, and ignore_changes.
Why are provisioners a last resort?
Provisioners (e.g., remote-exec) run scripts and break Terraform's declarative model and idempotency. Prefer cloud-init, pre-baked images, or configuration tools instead.
Scenario Questions
- Managing multiple environments: use separate state per environment plus reusable modules and variable files.
- Handling secrets: never hardcode; use a secrets manager or environment variables, mark variables
sensitive, and protect the state backend. - CI/CD with Terraform: run
fmt/validate/planon pull requests and gateapplybehind review, with remote state and locking.
Keep Learning
Pair this with our interview-questions library — including EKS, AKS & GKE and Prometheus & Grafana — and explore DevOps training to practise Terraform hands-on.
