AWS provider Practice Test 14 — 15 Questions

Question 1

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Variable Set at the organization level containing the AWS credentials as environment variables, and apply it to all workspaces.. Organization-level Variable Sets are designed to share variables across multiple workspaces, including sensitive credentials. By defining AWS access keys as environment variables in a variable set and applying it to all workspaces, you ensure every run has the necessary credentials without manual intervention. This approach centralizes management and reduces configuration drift.

Answer

Configure the AWS provider to use the default credential chain, which will automatically retrieve credentials from HCP Terraform's environment.

Answer

Create a Sentinel policy that injects the AWS credentials into each run's environment before execution.

Answer

Store the AWS credentials in a Terraform Cloud API token and reference it in the provider configuration using var.token.

Question 2

Your organization uses HCP Terraform to manage AWS infrastructure. A platform engineer has been assigned the 'Write' permission on a workspace but is still unable to modify the AWS credentials stored as workspace variables. Which HCP Terraform permission level is required to manage sensitive workspace variables?

Accepted Answer

Admin. Managing workspace variables, particularly sensitive ones like AWS credentials, requires Admin permission on the workspace. Write permission allows runs and applies but not variable management. Plan and Read are view-only levels. Therefore, the engineer must be granted Admin to edit the credentials.

Answer

Write

Answer

Plan

Answer

Read

Question 3

Your team uses HCP Terraform to manage AWS infrastructure. You need to allow a specific team of developers to apply changes in a workspace, but you do not want them to be able to modify workspace settings or delete the workspace. Which team permission should you assign to the developers?

Accepted Answer

Write. Write permission in HCP Terraform allows users to perform runs, including apply, but restricts administrative actions like changing settings or deleting the workspace. This provides the necessary operational access while protecting the workspace configuration. Admin would give too much control, and Read would not allow applies.

Answer

Read

Answer

Plan

Answer

Admin

Question 4

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that all workspaces in a specific project automatically inherit a set of environment variables containing AWS credentials. These variables must be available to all runs in those workspaces without manual configuration. What is the most efficient way to achieve this?

Accepted Answer

Create a variable set with the environment variables and assign it to the project.. Variable sets are designed to share variables across multiple workspaces. When assigned to a project, all workspaces in that project inherit the variables automatically, including new workspaces. This is the most efficient and maintainable solution. Other options require manual intervention or do not provide automatic inheritance.

Answer

Define the variables in each workspace's Terraform configuration using a shared module.

Answer

Use the HCP Terraform API to create the variables in each workspace via a script.

Answer

Configure a run trigger that copies variables from a template workspace to the target workspaces.

Question 5

You are designing a governance strategy for your HCP Terraform organization. You need to enforce that all AWS resources are tagged with a 'CostCenter' tag. The policy should block any run that creates resources without this tag, but you also want to allow a temporary exception for a migration project. Which combination of Sentinel enforcement level and policy set scoping should you use?

Accepted Answer

Use a hard-mandatory policy set scoped to all workspaces except the migration project, and a separate advisory policy set for the migration project.. To block non-compliant runs everywhere except the migration project, the hard-mandatory policy set must be scoped to all workspaces except that project. The migration project can then have an advisory policy set to log violations without blocking. This combination enforces the tagging requirement broadly while allowing the migration project to proceed with visibility.

Answer

Use a hard-mandatory policy set scoped to all workspaces, and create a separate policy set with an advisory policy for the migration project.

Answer

Use a soft-mandatory policy set scoped to all workspaces, and rely on developers to override when necessary.

Answer

Use a hard-mandatory policy set scoped only to the migration project, and an advisory policy set for all other workspaces.

Question 6

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The run fails immediately and cannot proceed to apply.. Hard-mandatory Sentinel policies enforce strict compliance and cannot be overridden. If the policy fails, the run is immediately halted and cannot proceed to apply. The user must correct the configuration to include the required tag and trigger a new run. This ensures no non-compliant infrastructure is deployed.

Answer

The policy failure is recorded as an advisory and the run continues automatically.

Answer

The run is queued for manual review by an organization owner before apply.

Answer

The run pauses and waits for a user with override permissions to approve continuation.

Question 7

You are managing an AWS S3 bucket with Terraform. The bucket has versioning enabled and contains critical data. You want to ensure that Terraform never destroys the bucket, even if someone runs terraform destroy. Which lifecycle meta-argument should you use?

Accepted Answer

prevent_destroy = true. The prevent_destroy meta-argument is specifically designed to protect resources from accidental deletion. When set to true, Terraform will produce an error if any plan attempts to destroy the resource, including during terraform destroy. This ensures the S3 bucket remains intact. Other meta-arguments either ignore changes, alter replacement order, or trigger replacement, but none prevent destruction.

Answer

ignore_changes = all

Answer

create_before_destroy = true

Answer

replace_triggered_by = [aws_s3_bucket_versioning.example]

Question 8

Your organization uses HCP Terraform with a private module registry. A developer wants to use a module from the registry in a new configuration. The module is versioned and published. What is the correct way to reference this module in the Terraform configuration?

Accepted Answer

Use the module source address in the format 'app.terraform.io///' with a version constraint.. Private modules in HCP Terraform are consumed by specifying a source address that includes the registry hostname, namespace, module name, and provider, along with a version constraint. This ensures Terraform retrieves the correct version from the registry, enabling version pinning and access control.

Answer

Use a Git URL pointing to the module's repository.

Answer

Download the module manually and place it in a local 'modules' directory, then reference it with a relative path.

Answer

Use the module's API endpoint URL directly in the source argument.

Question 9

An operations engineer needs to remove an aws_iam_role and its attached aws_iam_role_policy_attachment from Terraform management without deleting the role in AWS, because the role is shared with an external team. The configuration for both resources will also be deleted from the repository. Which command sequence accomplishes this?

Accepted Answer

terraform state rm aws_iam_role_policy_attachment.example, then terraform state rm aws_iam_role.example. Unmanaging resources without deleting them in the cloud requires removing their entries from state. terraform state rm performs exactly that, issuing no provider API calls, and ordering the attachment before the role keeps the state consistent. Destroying, moving, or merely editing configuration all either delete the real objects or leave them tracked.

Answer

Delete the resource blocks from the configuration and run terraform apply -refresh=false so Terraform forgets the resources.

Answer

terraform state mv aws_iam_role.example aws_iam_role.shared, then terraform apply to drop the old address

Answer

terraform destroy -target=aws_iam_role_policy_attachment.example, then remove the aws_iam_role block from state with terraform import

Question 10

You are defining an input variable for a Terraform module that will accept a map of environment names to configuration objects. The object should have an instance_type string and a min_size number. You want Terraform to validate that any provided value matches this structure. Which type constraint should you use for the variable?

Accepted Answer

type = map(object({ instance_type = string, min_size = number })). The requirement is a map where each key is an environment name and each value is an object with specific attributes. The type constraint map(object({ instance_type = string, min_size = number })) expresses exactly that. Terraform will enforce that the variable is a map and that each value conforms to the object schema, catching configuration errors early.

Answer

type = map(string)

Answer

type = object({ instance_type = string, min_size = number })

Answer

type = list(object({ instance_type = string, min_size = number }))

Question 11

An engineer is authoring a reusable module that accepts variable "subnets", typed as map(object({ cidr_block = string, public = bool })). The module must create one aws_subnet per entry, attaching an aws_route_table_association only when that entry's public attribute is true. The association resource must not appear at all for private subnets, and its key must match the subnet's map key. Which approach satisfies these requirements with the least waste?

Accepted Answer

Iterate aws_subnet with for_each = var.subnets, and iterate aws_route_table_association with for_each = { for k, v in var.subnets : k => v if v.public }.. Filtering a map with a for expression that includes an if clause yields a new map containing only the entries that satisfy the predicate, and using that map with for_each gives each association the same stable key as its subnet. This avoids index drift, keeps resource addresses stable across changes, and naturally expresses the conditional existence of the association without count arithmetic.

Answer

Use count = length(var.subnets) on both aws_subnet and aws_route_table_association, and set the association's count to the number of entries where public is true.

Answer

Iterate aws_subnet with count over keys(var.subnets), and use element() lookups inside aws_route_table_association with a dynamic "public" block to skip private entries.

Answer

Iterate aws_subnet with for_each = var.subnets, then give aws_route_table_association a single instance whose subnet_id is a list built from all public entries via a for expression.

Question 12

An operations engineer runs 'terraform init' in a directory where the configuration requires the AWS provider from the public registry. The machine has no direct internet access but can reach an internal Terraform registry mirror. Which action must be taken so that init succeeds using the mirror?

Accepted Answer

Configure a provider_installation block in the CLI configuration file (~/.terraformrc or terraform.rc) with a network_mirror or filesystem_mirror directive. Terraform reads provider installation settings from the CLI configuration file, not from the working directory configuration. A provider_installation block with network_mirror or filesystem_mirror directs Terraform to fetch providers from an internal source, which is the correct solution when the public registry is unreachable but a mirror is available.

Answer

Add a source argument pointing to the mirror URL inside the terraform block of the root configuration

Answer

Run 'terraform providers lock' with the -platform flag to pre-populate the lock file from the mirror

Answer

Set the TF_REGISTRY_CLIENT_TIMEOUT environment variable to a longer value and re-run init

Question 13

A team's CI pipeline runs 'terraform init' on Linux amd64 runners, while developers run it on macOS arm64 laptops. After a developer commits .terraform.lock.hcl generated on their laptop, the CI pipeline fails with 'provider ... does not have a package available for your current platform'. What is the most appropriate fix?

Accepted Answer

Run 'terraform providers lock -platform=linux_amd64 -platform=darwin_arm64' and commit the updated lock file. The dependency lock file records checksums per platform. When it is generated on only one platform, other platforms cannot verify their provider packages and init fails. Regenerating the lock file with terraform providers lock using -platform for each target platform adds the required hashes while keeping the file committed for reproducibility.

Answer

Delete .terraform.lock.hcl from version control and let each environment regenerate it independently

Answer

Add a provider_installation block with direct = true so Terraform ignores the lock file on CI

Answer

Set the TF_PLUGIN_CACHE_DIR environment variable on the CI runner to reuse the developer's cached provider

Question 14

You are using a for expression to create a map from a list of objects. Each object has an attribute 'name' that is a string. You want the resulting map's keys to be the 'name' values and the values to be the entire objects. However, you encounter an error because some objects have duplicate 'name' values. How can you modify the for expression to handle duplicates by grouping objects with the same name into a list, so that the map values become lists of objects?

Accepted Answer

{ for obj in var.objects : obj.name => obj... }. The correct for expression includes the grouping ellipsis (...) after the value expression. This tells Terraform to collect all values that share the same key into a list, thus handling duplicates by grouping. Without the ellipsis, duplicate keys cause an error. The other options either omit the ellipsis, use the wrong delimiter, or incorrectly attempt to wrap values without grouping.

Answer

{ for obj in var.objects : obj.name => obj }

Answer

[ for obj in var.objects : obj.name => obj ]

Answer

{ for obj in var.objects : obj.name => [obj] }

Question 15

During a CI pipeline run, `terraform init` fails with an error stating that the checksums recorded in `.terraform.lock.hcl` do not match any of the packages available from the configured provider mirror. The mirror is an internal registry serving only linux_amd64 builds, while the lock file was generated on a developer's darwin_arm64 laptop. Which action resolves the failure while keeping the lock file authoritative for CI?

Accepted Answer

Run `terraform providers lock` with `-platform=linux_amd64` against the internal mirror and commit the updated lock file.. The lock file pins provider packages by version and by platform-specific checksums. A lock file containing only darwin_arm64 hashes cannot validate a linux_amd64 package, regardless of mirror configuration. Re-running `terraform providers lock` with the target platform against the internal mirror records the linux_amd64 hashes, after which CI can verify and install the provider.

Answer

Add a `provider_installation` block that maps the AWS provider to the mirror and re-run `terraform init -upgrade` to refresh the hashes.

Answer

Delete `.terraform.lock.hcl` in the pipeline and let `terraform init` recreate it from the mirror on every run.

Answer

Set the environment variable `TF_CLI_CONFIG_FILE` to point at a CLI configuration that disables checksum verification during init.