AWS provider Practice Test 21 — 15 Questions

Question 1

A platform team is preparing a reusable module for internal distribution. They want to ensure that consumers can reliably upgrade the module without unexpected breaking changes. Which TWO practices best support this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Publish each change as a new tagged release and expose the version through the module registry so consumers can pin constraints.. Reliable upgrades depend on two things: immutable, semantically versioned releases that consumers can constrain, and a well-documented interface that makes the contract explicit. Tagged releases let teams pin and roll back. Documentation communicates the impact of changes. Practices like build counters, moving branch references, or file layout do not provide the versioning discipline or contract clarity required for safe upgrades.

Answer

Avoid using semantic version numbers and instead increment a build counter with each commit to the default branch.

Answer

Store all module code in a single monolithic file to simplify diffing between releases.

Answer

Require all consumers to use the latest commit hash from the default branch to stay current with fixes.

Question 2

You are creating a security group in AWS and need to define multiple ingress rules based on a list of port numbers. Which meta-argument is most appropriate to use to create one resource instance per port?

Accepted Answer

for_each. The for_each meta-argument accepts a map or set of strings and creates one resource instance per element, making it the correct choice when iterating over a list of port numbers (converted to a set or map). Unlike count, for_each produces stable, keyed instance addresses (e.g., aws_security_group_rule.ingress["22"]) so adding or removing a port doesn't cause unrelated rules to be destroyed and recreated. This is the idiomatic Terraform pattern for defining multiple ingress rules from a collection of ports.

Answer

instance_count

Answer

count

Answer

dynamic

Question 3

You are iterating over a map using for_each. You need to access the key of the current map element. Which object do you use?

Accepted Answer

each.key. When using for_each with a map, Terraform automatically creates an each object that contains two attributes: each.key and each.value. each.key gives you the map key for the current iteration, while each.value gives the corresponding value. Therefore, to access the key of the current map element, you use each.key.

Answer

var.key

Answer

count.key

Answer

each.value

Question 4

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

Accepted Answer

Modifying workspace settings like variable sets and execution modes.. The 'Workspace: Settings' permission in HCP Terraform grants the ability to modify workspace-level configuration, including variable sets, execution modes (remote/local/agent), and other workspace settings. It does not grant run execution or deletion rights. This permission is typically assigned to workspace admins who need to tune how runs behave.

Answer

Viewing plan and apply logs only.

Answer

Triggering runs manually.

Answer

Deleting the workspace.

Question 5

You are managing an HCP Terraform organization with multiple workspaces. A security requirement mandates that all workspaces use a specific version of the AWS provider (5.0.0 or later) and that any deviation triggers a notification to the security team. You have configured a Sentinel policy to check the provider version. Which enforcement level should you set for this policy to meet the requirement while allowing developers to proceed with their work if they acknowledge the risk?

Accepted Answer

soft-mandatory. soft-mandatory enforcement requires an authorized user to explicitly override a policy failure before the run can continue. This matches the need to allow developers to proceed after acknowledging the risk. The override is recorded, and notifications can be set up via HCP Terraform's notification features. hard-mandatory would block all non-compliant runs, advisory would not require acknowledgment, and disabled would ignore the policy.

Answer

advisory

Answer

hard-mandatory

Answer

disabled

Question 6

A team defines a variable `allowed_ports` as `list(number)` and wants to validate that every value is between 1 and 65535 before any resources are planned. They add a `validation` block to the variable. Which configuration correctly enforces this constraint?

Accepted Answer

validation { condition = alltrue([for p in var.allowed_ports : p >= 1 && p <= 65535]) error_message = "Ports must be between 1 and 65535." }. Variable validation conditions must evaluate to a boolean that is true when the input is acceptable. To enforce a per-element range, the condition should reduce the list of per-port checks with `alltrue`, ensuring every element meets the bounds. This catches invalid ports before planning and produces the configured error message.

Answer

validation { condition = anytrue([for p in var.allowed_ports : p >= 1 && p <= 65535]) error_message = "Ports must be between 1 and 65535." }

Answer

validation { condition = contains(var.allowed_ports, 80) error_message = "Ports must be between 1 and 65535." }

Answer

validation { condition = length(var.allowed_ports) > 0 error_message = "Ports must be between 1 and 65535." }

Question 7

An operations engineer maintains a module that creates an AWS RDS instance. The module block in the root configuration includes a `providers` argument mapping the module's `aws` provider to an aliased provider configuration targeting a secondary region. A new resource is added inside the module that uses `aws.global` as an explicit provider. What happens when the engineer runs `terraform plan`?

Accepted Answer

Terraform errors because the module only received a mapping for the default `aws` configuration, so `aws.global` has no configuration passed in.. Modules receive provider configurations only through explicit `providers` mappings in the module block. When a resource inside the module references an aliased provider such as `aws.global`, that alias must have been passed in. Because the root only supplied the default `aws` configuration, the alias is undefined inside the module and planning fails with an error about the missing provider configuration.

Answer

Terraform automatically inherits the root module's `aws.global` provider configuration for the child module.

Answer

Terraform errors because the module does not declare `aws.global` in its required_providers block.

Answer

Terraform silently falls back to the default `aws` provider configuration in the child module and plans successfully.

Question 8

You maintain a Terraform module that deploys AWS resources into several environments. Rather than declaring a separate variable per environment, you want a single input variable that accepts a map of environment names to configuration objects, where each object contains a region string and an instance count number, and your configuration should reject any input that does not match this shape at plan time. Which variable type constraint should you declare?

Accepted Answer

variable "environments" { type = map(object({ region = string, count = number })) }. A map of objects is the only constraint that simultaneously enforces named environment keys and a fixed attribute schema with region as a string and count as a number. Terraform validates caller input against that schema during planning and converts compatible primitive values automatically, so malformed input fails early rather than producing broken resources later.

Answer

variable "environments" { type = list(object({ region = string, count = number })) }

Answer

variable "environments" { type = map(string) }

Answer

variable "environments" { type = any }

Question 9

Where are lifecycle meta-arguments placed within a Terraform configuration?

Accepted Answer

Inside the resource block, within a 'lifecycle' block.. Lifecycle meta-arguments are used to customize the behavior of a specific resource, such as preventing its destruction or ignoring changes to certain attributes. They are defined within a nested 'lifecycle' block inside the resource block, as they directly modify that resource's lifecycle. This placement ensures the arguments apply only to that resource, not globally or to modules/providers.

Answer

At the root of the configuration file.

Answer

Inside the module block.

Answer

Inside the provider block.

Question 10

Your organization uses HCP Terraform with the AWS provider. You want to share a set of AWS region and tagging variables across all workspaces in a specific project without duplicating them in each workspace. Which HCP Terraform feature should you use?

Accepted Answer

Variable sets applied to the project.. Variable sets in HCP Terraform are designed to share variables across multiple workspaces. You can create a variable set containing the AWS region and tagging variables and apply it to the entire project, ensuring all current and future workspaces in that project inherit the variables. This centralizes management and reduces duplication.

Answer

Terraform input variables with default values in the root module.

Answer

Workspace-specific variables defined in each workspace's variables tab.

Answer

Environment variables set in the run's execution environment.

Question 11

A platform team wants to prevent any workspace in their HCP Terraform organization from provisioning EC2 instances with public IP addresses. They need the policy to block a run before apply whenever a non-compliant plan is detected, and they want the failure reason surfaced to the developer. Which approach meets these requirements?

Accepted Answer

Attach a Sentinel or OPA policy set to the organization with a hard-mandatory policy that inspects the plan and denies non-compliant EC2 resources.. Organization-level policy sets with hard-mandatory enforcement evaluate the plan before apply and deny non-compliant changes. Because policies are attached centrally, every workspace is covered without per-module changes, and the policy can return a clear message explaining which attribute violated the rule, giving developers actionable feedback.

Answer

Configure an AWS Config rule that flags instances with public IPs and rely on it to stop the Terraform apply.

Answer

Use a `terraform_data` resource with a local-exec provisioner to scan the plan JSON and fail the apply.

Answer

Add a `precondition` block to each EC2 resource that checks the public IP attribute during apply.

Question 12

Your organization uses HCP Terraform with several projects. A compliance officer must be able to read the results of every policy evaluation and run across all projects, but must not be able to modify workspaces or trigger runs. Which approach grants exactly these rights?

Accepted Answer

Assign the officer the organization-level read permission and rely on project visibility to expose run and policy results.. Organization-level read permission is designed for users who need to observe activity across all projects without changing anything. It reveals workspace runs, plans, and policy evaluation results while withholding the ability to modify configuration or queue runs. Because it applies at the organization scope, it automatically covers future projects and workspaces the compliance officer must review.

Answer

Create a team with the plan permission on each workspace and add the officer to that team.

Answer

Add the officer to each project's team with the write permission set on every workspace.

Answer

Give the officer the organization owner role and instruct them not to make changes.

Question 13

A module author wants to conditionally create an AWS CloudWatch log group only when a variable named enable_logging is true. The log group resource is defined inside a child module. Which approach correctly implements this conditional creation within the module?

Accepted Answer

Use a count meta-argument on the resource with count = var.enable_logging ? 1 : 0.. Conditional resource creation in Terraform is achieved using the count or for_each meta-arguments. Applying count = var.enable_logging ? 1 : 0 directly on the resource allows it to be created only when the variable is true. This pattern works inside modules and is the idiomatic way to conditionally manage resources. Other methods like dynamic blocks or lifecycle arguments do not control resource existence.

Answer

Add a lifecycle block with create_before_destroy = var.enable_logging.

Answer

Use a null_resource with a trigger that runs a local-exec provisioner to create the log group via AWS CLI.

Answer

Wrap the resource in a dynamic block with for_each = var.enable_logging ? [1] : [].

Question 14

Where can you view the historical state versions in HCP Terraform?

Accepted Answer

The States tab. The States tab in an HCP Terraform workspace displays the historical list of state versions, including the serial number, the run that produced each version, timestamps, and options to download or roll back. This is the dedicated location for inspecting state history.

Answer

The Variables tab

Answer

The Runs tab

Answer

The Settings tab

Question 15

Your team manages AWS infrastructure with Terraform. A module needs to accept a map of environment names to instance types, where each instance type must be one of a fixed set of allowed values. You want Terraform to reject invalid configurations during plan with a clear error message. Which approach best validates the variable input?

Accepted Answer

Define the variable with type = map(string) and add a validation block with a condition that checks each value against the allowed list using the contains function and alltrue.. Variable validation blocks allow you to enforce custom constraints on input variables. By using a condition that checks all values in the map against a list of allowed instance types, you ensure that invalid configurations are caught during plan with a helpful error message. This is the intended way to validate complex variable inputs in Terraform.

Answer

Define the variable with type = map(string) and use a lifecycle precondition on each AWS instance resource that checks the instance type.

Answer

Define the variable with type = map(string) and add a custom validation using the file function to read a list of allowed values from an external file.

Answer

Define the variable with type = map(string) and rely on the AWS provider to reject invalid instance types when the plan is applied.