Provider Management

What is the purpose of the 'terraform providers lock' command?

You are creating a custom provider. What is the standard language used to write Terraform providers?

You need to manage resources in two different AWS regions using the same provider configuration. How do you achieve this?

If you want to use a provider that is not published in the Terraform Registry, how do you install it?

A team wants to ensure their Terraform configuration uses a specific major version of the AWS provider to prevent breaking changes. Which block should they use?

Where are providers physically stored by default when running 'terraform init'?

Which meta-argument is used to explicitly associate a resource with a non-default provider instance?

A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?

Which file is automatically generated to lock provider versions and their checksums?

If a developer wants to use a provider that is not in the public registry, can they still use it?

What is the primary function of the 'source' attribute in the 'required_providers' block?

What happens if you have a provider version conflict in your module dependencies?

When using multiple provider instances with different regions, what must be defined in the provider configuration?

What is the correct way to specify a version constraint for a provider that must be at least 3.0 but less than 4.0?

When defining a provider in Terraform, what does the 'alias' meta-argument signify?

Which block is used to configure provider-level settings like region or profile?

Which command helps verify if the providers are properly initialized?

When writing a custom provider, what is the 'Schema' used for?

If a user omits the 'version' in 'required_providers', what version does Terraform use?

What is the effect of running 'terraform init -upgrade' on the '.terraform.lock.hcl' file?

How do you pass a provider instance from a root module into a child module?

If a resource is not specified with a provider meta-argument, which provider instance does it use?

Which of the following are valid ways to specify provider versions? (Select TWO)

What are common reasons to use multiple provider instances? (Select TWO)

Which of the following are true regarding the .terraform.lock.hcl file? (Select TWO)

When debugging provider issues, which commands are most useful? (Select THREE)

Which are characteristics of the Terraform Plugin SDK? (Select TWO)

What are the ways to configure provider credentials? (Select THREE)

An operations engineer runs 'terraform init' in a directory where the configuration requires the AWS provider from the public registry. The machine has no direct internet access but can reach an internal Terraform registry mirror. Which action must be taken so that init succeeds using the mirror?

A platform team maintains a shared Terraform child module that contains only a single `aws_s3_bucket` resource and no `provider` block. The module's `versions.tf` declares `required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }`. A consumer root module configures the AWS provider with `region = "us-west-2"` and calls the child module without any `providers` argument. During `terraform plan`, which AWS region will be used to evaluate the bucket resource inside the child module?

A team's CI pipeline runs 'terraform init' on Linux amd64 runners, while developers run it on macOS arm64 laptops. After a developer commits .terraform.lock.hcl generated on their laptop, the CI pipeline fails with 'provider ... does not have a package available for your current platform'. What is the most appropriate fix?

An operations engineer runs terraform init in a CI pipeline and notices the .terraform.lock.hcl file lists hashes for linux_amd64 only. A developer on macOS arm64 runs terraform init in the same repository and Terraform downloads a different provider build. The team wants the lock file to include hashes for both platforms so CI and developer workstations verify the same provider artifacts. Which command should the engineer run?

A platform team maintains a shared Terraform module that must run in three AWS regions simultaneously within a single root configuration. The module itself declares only a generic `aws` provider requirement with no alias, and the team wants each module instance to use a different region without editing the module source. Which configuration approach satisfies this requirement?

During a CI pipeline run, `terraform init` fails with an error stating that the checksums recorded in `.terraform.lock.hcl` do not match any of the packages available from the configured provider mirror. The mirror is an internal registry serving only linux_amd64 builds, while the lock file was generated on a developer's darwin_arm64 laptop. Which action resolves the failure while keeping the lock file authoritative for CI?

An operations engineer runs terraform init in a CI pipeline that has no outbound internet access but does have a local filesystem mirror of providers. The configuration uses the AWS provider and a custom provider named example. The engineer runs: terraform init -plugin-dir=/opt/terraform/plugins. What is the result?

A team uses the AWS provider to manage resources in three accounts: development, staging, and production. The root module must create an `aws_iam_role` in the production account while all other resources remain in the default development account. The production account's provider configuration is already declared with `alias = "prod"`. Which change to the production `aws_iam_role` resource is required?

A team wants to ensure that their Terraform configuration always uses a specific version of the AWS provider and that the version constraint is enforced across all modules. They add the following to the root module's terraform block: terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 4.0" } } } A child module declares the AWS provider without a version constraint. What happens when terraform init is run?

Your team maintains a Terraform configuration that uses the AWS provider with an S3 backend. A security review requires that provider credentials never be stored in plaintext in the configuration or state. You currently use a shared credentials file referenced by the `profile` argument. Which change best satisfies this requirement while keeping the configuration portable across CI and developer machines?

A platform team maintains a shared child module that creates AWS resources in three different regions. The root module calls this child module three times, once per region. The child module currently declares only a default AWS provider configuration. What is the correct way to make each module instance use a distinct region without modifying the child module's resource blocks?

An operations engineer runs `terraform init` in a directory whose configuration uses the AWS provider. After init, the engineer inspects `.terraform.lock.hcl` and sees multiple `zh:` hash entries alongside `h1:` entries for the hashicorp/aws provider. A colleague on a different platform then runs `terraform init` and Terraform reports that the provider package does not match any of the checksums recorded in the lock file. Which action most directly resolves the mismatch while preserving reproducibility?

A Terraform module is used by multiple teams. The module requires the AWS provider but should not enforce a specific provider configuration. The module's author wants to ensure that when the module is used, the caller must pass an AWS provider instance with a specific alias. What should the author include in the module's terraform block?

A platform team publishes an internal module that wraps the AWS provider. They want to ensure that consumers cannot use a provider version newer than 5.x but can use any 5.x release. The module's `required_providers` currently specifies `version = "~> 5.0"`. A consumer's root module specifies `version = "~> 4.0"` for the same provider. What happens when the consumer runs `terraform init`?

An operations engineer runs `terraform init` and notices Terraform downloads the AWS provider from `registry.terraform.io`. The organization requires all provider packages to come from an internal mirror at `mirror.example.com` for compliance. The engineer adds a `provider_installation` block to the CLI configuration file. Which CLI configuration file location and block structure will make Terraform use the mirror for the AWS provider while still allowing other providers from the public registry?

A root module configures the AWS provider with `region = "eu-central-1"` and declares an aliased configuration `aws.dr` pointing at `region = "eu-west-1"`. The team wants a single `aws_route53_record` resource to be created in the DR region while all other AWS resources stay in eu-central-1. Which two statements correctly describe how provider selection works for this resource? (Choose two.)

A team wants to reuse an existing, manually managed AWS provider configuration located in a separate directory as the source of truth for a new Terraform configuration, instead of declaring a fresh provider block. Which statement describes how Terraform obtains provider configurations from elsewhere?

A CI pipeline runs Terraform against an AWS account and must assume a dedicated deployment role rather than use long-lived access keys. The role ARN differs between the staging and production pipelines. The team wants a single configuration that works in both environments without embedding credentials. Which approach correctly configures the AWS provider to assume the pipeline-specific role?

A platform team is standardizing Terraform provider usage across many AWS accounts. They want to enforce a specific AWS provider version and ensure every root module records the provider source explicitly so that ambiguous provider lookups do not occur. Which two actions should the team take? (Choose two.)

A consultant joins a project and runs `terraform init` on a configuration that references `hashicorp/aws` version `~> 5.0`. The init succeeds, but a teammate later reports that their init fails with a checksum mismatch for the same provider version. The consultant's platform is `linux_amd64` and the teammate's is `darwin_arm64`. What is the most likely explanation and the correct remediation?

A consultant is authoring a module that must support both AWS commercial and AWS China regions. The module needs to create resources in whichever partition the caller selects, and the caller may also want to create resources in a second region within the same partition. The module must not hardcode any region. Which approach best satisfies this?

A platform engineer is preparing a Terraform configuration that will run in an environment where the AWS provider must be pinned to a specific minor version, and the provider must be sourced from the public Terraform Registry. The engineer also wants to ensure that `terraform init` records the selected version and checksums for later verification. Which two actions should the engineer take? (Choose two.)

A DevOps engineer runs `terraform init` in a CI pipeline that has no internet access. The configuration uses the AWS provider from the public Terraform Registry. The pipeline fails because Terraform cannot download the provider. The team wants to use a local filesystem mirror containing the required provider packages. Which Terraform CLI configuration block should be used to point Terraform to the local mirror?