Terraform Modules

Which directory structure is considered standard for a Terraform module?

What is the primary benefit of using a module registry compared to a local file path for module distribution?

When refactoring a large infrastructure configuration, you move a resource into a child module. How do you handle the existing state to prevent Terraform from destroying and recreating the resource?

You have a nested module structure. How can you pass a variable from the root module through an intermediate module to a leaf module?

You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?

You need to output a complex object from a child module to be used by the root module. What is the best practice for defining the output?

Your team requires a custom module to be versioned strictly to prevent breaking changes during deployments. What is the recommended way to reference a module from a private Git repository?

You are building a module that needs to be consumed by multiple teams. How should you structure your module to ensure that the root module can provide values for variable definitions without hardcoding them in the module itself?

When should you use the 'for_each' meta-argument within a module?

Where do module outputs appear after a 'terraform apply'?

How can you protect a module's inputs from receiving incorrect types of data?

You want to use a module that is hosted in a private GitHub repository. Which authentication method should Terraform use to access it?

What is the purpose of the 'terraform init' command when working with modules?

If a module has a required variable but you do not provide it in the calling configuration, what happens?

You are using a module that depends on a specific provider version. Where should this constraint be defined?

Which argument in a module block allows you to provide a custom name to the module instance?

What is the impact of using 'sensitive = true' in a module output?

You need to share a module across your entire organization. Which registry type should you use?

What is the recommended approach for managing a module that has grown too large?

When a module is updated, how do you ensure that all environments using this module get the update?

What command do you run to view the documentation for a module that has been published to a registry?

Why would you use a 'locals' block within a module instead of passing everything through variables?

Which THREE actions are best practices when publishing a module to a private registry?

Which THREE of these are benefits of using modules in Terraform?

Which TWO of the following are true regarding variable validation in modules?

Which THREE items should be included in a well-documented Terraform module?

Which TWO of the following are true about the '.terraform' directory?

Which THREE of the following are components of the 'source' string when using the Terraform Registry?

Which TWO of the following are valid ways to pass a provider configuration to a child module?

A platform team maintains a module that provisions a VPC and subnets. They want to expose the subnet IDs to callers without allowing callers to modify them. Which Terraform construct should they use in the module?

A module uses for_each over a map to create several IAM roles, and the map keys are derived from a variable that callers may change. The team wants to avoid replacing roles when only the map's values change. Which change to the module is required?

You are using a module from the public Terraform Registry in a production configuration. After running terraform init -upgrade, you notice that the module version changed unexpectedly and caused a breaking change in your infrastructure. You want to prevent this from happening again. Which approach should you take?

A platform team maintains a shared module in a private Terraform registry. They want to ensure that any configuration consuming this module always pulls the exact same version, even if a newer version is published. The module source is specified as "app.terraform.io/example-corp/vpc/aws". Which source argument change should be applied?

Your team maintains a Terraform module that provisions an AWS VPC. The module is used by multiple teams. You need to allow callers to customize the CIDR block but enforce a default if not provided. How should you define the variable in the module?

You are updating a shared Terraform module that provisions an Amazon RDS instance. The module currently defines an input variable `engine_version` with `default = "14.7"`. Your team wants to ensure that any consumer who does not explicitly set `engine_version` still gets a valid value, but you also want to prevent consumers from accidentally passing a null value that would cause an API error. Which change should you make to the variable definition?

A platform team publishes a shared networking module to a private Terraform registry. Several consuming teams pin the module using `version = "~> 2.1.0"`. The platform team later adds a new optional input variable to the module and publishes it as version 2.2.0 without changing any existing behavior. What is the effect on the consuming teams' next `terraform init`?

A module author wants to conditionally create an AWS CloudWatch log group only when a variable named enable_logging is true. The log group resource is defined inside a child module. Which approach correctly implements this conditional creation within the module?

You maintain a Terraform module that provisions an AWS Application Load Balancer and its target groups. Consumers frequently need to attach additional security groups to the ALB, but the module currently hardcodes a single security group. You want to allow consumers to supply a list of security group IDs without breaking existing module calls. Which change should you make to the module's variables and resource configuration?

You are developing a Terraform module that creates an AWS EC2 instance. You want to expose the instance's private IP address to the caller. How should you define this in the module?

An operations engineer maintains a module that creates an AWS RDS instance. The module block in the root configuration includes a `providers` argument mapping the module's `aws` provider to an aliased provider configuration targeting a secondary region. A new resource is added inside the module that uses `aws.global` as an explicit provider. What happens when the engineer runs `terraform plan`?

A team is designing a reusable Terraform module that provisions an AWS VPC. They want to ensure the module is flexible and follows best practices for input variables. Which two practices should they implement? (Choose two.)

You are authoring a module that creates an AWS RDS instance. The module must enforce that the `engine` input is one of `mysql`, `postgres`, or `mariadb`. A consumer passes `engine = "aurora"`. What is the most appropriate way to handle this in the module to provide a clear error message and enforce the constraint?

A module accepts a variable 'environment' used only to build a name prefix. The team wants to prevent callers from passing values outside a fixed set without duplicating validation in every caller. What is the correct approach?

You are writing a Terraform module that creates an AWS S3 bucket. You want to ensure that the bucket name is globally unique and follows a naming convention that includes the AWS account ID and region. How can you generate a unique name within the module?

A module outputs an AWS S3 bucket name. The root configuration needs to pass this output to another module as an input variable. How should the root configuration reference the output from the first module?

Your team publishes an internal Terraform module to a private registry. A consumer wants to pin the module to a specific version to avoid unexpected changes. The module source is `app.terraform.io/example-org/vpc/aws`. Which source argument correctly pins the module to version 2.3.0?

You are writing a module that creates an AWS Security Group. The module accepts a variable `ingress_rules` defined as a list of objects with `from_port`, `to_port`, and `protocol`. You want to ensure that the module's interface is flexible enough to allow callers to add or remove rules without modifying the module code. Which Terraform feature should you use to iterate over the list and create dynamic ingress blocks?

You are creating a Terraform module that will be used by multiple teams. You want to ensure that the module is reusable and maintainable. Which TWO practices should you follow when designing the module's interface? (Choose two.)

You are writing a reusable module that creates an AWS S3 bucket and an associated bucket policy. The module will be consumed by multiple teams. Which TWO practices should you follow to make the module robust and maintainable? (Choose two.)

You are refactoring a module that previously used `count` to create multiple AWS IAM users. The module now uses `for_each` with a map of usernames to user details. After the refactor, you run `terraform plan` and see that Terraform wants to destroy and recreate all existing IAM users. What is the most likely cause, and how can you avoid this disruption?

You are designing a reusable Terraform module that will be consumed by multiple teams. To ensure the module is maintainable and follows best practices, which TWO of the following should you implement? (Choose two.)

You have a root module that calls a child module to create an AWS VPC. The child module defines an output named `vpc_id`. After running `terraform apply`, where can you find the value of `vpc_id`?

You are developing a module that creates an AWS Lambda function. The module accepts a variable `environment` and must set the Lambda function's `environment` block with variables `LOG_LEVEL` and `STAGE`. The values for these should be derived from the `environment` variable. How should you define the variable and use it within the module?

A module author wants to prevent callers from accidentally overriding a critical naming convention. The module already computes a `bucket_name` local. The author wants to expose it to callers without allowing them to set it. Which approach correctly enforces this behavior?

You have a module `terraform-aws-modules/vpc/aws` version `3.14.0` from the public Terraform Registry. You want to ensure that your configuration always uses this exact version and does not automatically upgrade to newer versions. Which version constraint should you specify in the module block?

A platform team is preparing a reusable module for internal distribution. They want to ensure that consumers can reliably upgrade the module without unexpected breaking changes. Which TWO practices best support this goal? (Choose two.)

You have written a Terraform module that outputs the ARN of an AWS S3 bucket. A user of the module wants to reference this output in their root configuration. How should they access it?

You are writing a module that creates an AWS EC2 instance and an associated security group. The module has a variable `instance_type` with a default of `t3.micro`. A consumer wants to override this default for a production environment. How should the consumer pass a different value when calling the module?