AWS provider Practice Questions 1 — 50 Questions

Question 1

You need to share a module across your entire organization. Which registry type should you use?

Accepted Answer

A private module registry in Terraform Cloud or Enterprise.. A private module registry in Terraform Cloud or Enterprise is the correct answer because it is purpose-built for sharing Terraform modules within an organization. It provides versioned, discoverable modules with access control, integrates natively with Terraform CLI/Cloud workflows, and supports private module sourcing via the `terraform init` command. This ensures secure, consistent, and governed reuse across teams, which is exactly what the scenario requires.

Answer

The public Terraform Registry.

Answer

A shared network drive.

Answer

An S3 bucket with public read access.

Question 2

You want to pass a complex object type to a module, but you need to ensure specific attributes are present. How do you define this in the variable block?

Accepted Answer

type = object({...}). The object({...}) type constraint lets you define a schema with specific named attributes and their types, ensuring required attributes are present and correctly typed. This is the correct way to pass a complex object with enforced structure to a module. It validates at plan time and rejects missing or extra attributes as configured.

Answer

type = map(any)

Answer

type = list(object)

Answer

type = tuple([...])

Question 3

Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?

Accepted Answer

Create a Sentinel policy that uses the tfrun import to access the cost estimation data and enforce a hard-mandatory policy when the delta exceeds $500.. Cost estimation in HCP Terraform provides data that Sentinel policies can evaluate. By writing a hard-mandatory policy that checks the monthly cost delta from the cost estimate and fails if it exceeds $500, you enforce the compliance rule automatically for all runs in the finance project. This leverages the existing cost estimation feature and the policy-as-code framework.

Answer

Configure a run trigger from a cost monitoring workspace to the finance workspaces to automatically reject runs that exceed the threshold.

Answer

Enable the 'Cost Estimation' setting on each finance workspace and manually review the cost estimate before applying.

Answer

Set a workspace variable named COST_THRESHOLD to 500 and rely on Terraform's AWS provider to enforce it during plan.

Question 4

Which command helps verify if the providers are properly initialized?

Accepted Answer

terraform providers. 'terraform providers' lists all providers required by the configuration, confirming they are initialized.

Answer

terraform validate

Answer

terraform show

Answer

terraform plan

Question 5

Which TWO of the following are valid uses of the 'for' expression?

Accepted Answer

Generating a list. In Terraform, the 'for' expression is used to transform and produce collection values: option B is correct because a 'for' expression over a list or set returns a tuple/list, e.g. [for s in var.subnets : upper(s)], which generates a list. Option E is correct because using the curly-brace form, e.g. {for k, v in var.tags : k => upper(v)}, produces a map (object) of key-value pairs. Option A is not a use of 'for' because resources are declared with a 'resource' block, not an expression. Option C is wrong because provider configuration is handled by 'provider' blocks and required_providers, not 'for'. Option D is wrong because dynamic blocks are created with the 'dynamic' block and its 'for_each' argument, not with a 'for' expression.

Answer

Defining a resource

Answer

Managing provider blocks

Answer

Creating dynamic blocks

Question 6

When a resource is marked as 'tainted', what is the expected outcome of the next 'terraform apply'?

Accepted Answer

It is destroyed and recreated.. A tainted resource is one Terraform has marked as degraded or partially created, so the next 'terraform apply' will destroy the existing object and create a fresh replacement. This is the standard recovery mechanism when a resource is in an unhealthy or unknown state but you want to keep it managed by Terraform.

Answer

It is ignored.

Answer

It is removed from the state file.

Answer

It is updated in place.

Question 7

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. The 'terraform init' command is used to initialize a Terraform working directory, and when migrating from local state to HCP Terraform, it detects the backend configuration change and prompts to migrate the state. This is the standard command to set up the backend and perform the migration. Other commands are not used for this purpose.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 8

Which TWO of the following are standard stages of an HCP Terraform run pipeline?

Accepted Answer

Policy Check.. Option A (Policy Check) is correct because HCP Terraform's run pipeline includes a Policy Check stage where Sentinel or OPA policies are evaluated against the plan before it can be applied, enforcing governance and compliance. Option C (Plan) is correct because the Plan stage is a core phase of every run, where Terraform generates an execution plan comparing the current state to the desired configuration. The pipeline stages are typically Plan, Policy Check, and Apply, so these two fit the standard sequence. Option B (Code linting) is not a pipeline stage; linting is done externally by tools like tflint or pre-commit hooks, not by HCP Terraform's run workflow. Option D (Automatic refactoring) is not a feature of the run pipeline; Terraform does not automatically rewrite configurations. Option E (State migration) is not a pipeline stage; state migration occurs when changing backends or workspaces, not as a standard run phase.

Answer

Code linting.

Answer

Automatic refactoring.

Answer

State migration.

Question 9

If a user wants to ensure that a resource's lifecycle is managed by Terraform but wants to bypass the 'prevent_destroy' protection, what is the best approach?

Accepted Answer

Remove the prevent_destroy block from the configuration and apply.. The prevent_destroy lifecycle meta-argument is a configuration-level protection, not a state-level one. To bypass it, you must edit the configuration to remove (or comment out) the prevent_destroy argument from the lifecycle block, then run terraform apply so the plan reflects the new configuration. Only after the argument is gone from the config can terraform destroy proceed against that resource.

Answer

Add 'ignore_changes = [prevent_destroy]' to the block.

Answer

Use 'terraform state rm' to remove the constraint.

Answer

Use 'terraform destroy -force-remove-prevent-destroy'.

Question 10

Which of the following is a primary benefit of using a Private Module Registry?

Accepted Answer

It allows central management and version control of reusable modules.. A Private Module Registry (available in Terraform Cloud/Enterprise and as a self-hosted registry) provides a centralized, versioned catalog of reusable modules that teams can publish, discover, and consume. It enforces versioning and access control, so consumers pin module versions and get consistent, auditable infrastructure patterns across the organization. This is its primary benefit over ad-hoc Git-based module sourcing.

Answer

It encrypts all Terraform state files.

Answer

It forces all workspaces to use the same module versions.

Answer

It automatically generates cost estimates for all modules.

Question 11

You manage an Amazon RDS instance with Terraform. During an unrelated deployment, a junior engineer runs `terraform apply` and the instance is unexpectedly destroyed and recreated, causing a brief outage. You need to ensure that future `terraform apply` runs fail before any destructive change can be planned for this database. Which configuration should you add to the `aws_db_instance` resource?

Accepted Answer

Add `lifecycle { prevent_destroy = true }` to the `aws_db_instance` resource.. The prevent_destroy lifecycle argument is the only mechanism that makes Terraform refuse to execute a plan containing the destruction of that specific resource. It acts as a guardrail during the plan phase, so the apply fails before any destructive API call is made. ignore_changes, create_before_destroy, and state rm all address different concerns and none of them block a replacement.

Answer

Add `lifecycle { create_before_destroy = true }` to the `aws_db_instance` resource.

Answer

Run `terraform state rm aws_db_instance.main` to detach the instance from state.

Answer

Add `lifecycle { ignore_changes = [engine] }` to the `aws_db_instance` resource.

Question 12

A team wants to pass a variable "allowed_ports" to a module and guarantee at apply time that every value is an integer between 1024 and 65535, rejecting invalid plans with a clear message. They prefer the validation to live in the variable block so callers get immediate feedback. Which declaration accomplishes this?

Accepted Answer

variable "allowed_ports" { type = list(number) validation { condition = alltrue([for p in var.allowed_ports : p >= 1024 && p <= 65535]) error_message = "Ports must be between 1024 and 65535." } }. A variable validation block with alltrue() over a per-element for expression evaluates the range predicate for every port and fails the plan when any element falls outside 1024–65535. Placing it in the variable block gives callers immediate, clearly worded feedback, and the list(number) type constraint handles element typing before the range check executes.

Answer

variable "allowed_ports" { type = list(number) validation { condition = can(regex("^[0-9]+$", join(",", var.allowed_ports))) error_message = "Ports must be between 1024 and 65535." } }

Answer

variable "allowed_ports" { type = list(number) validation { condition = length(var.allowed_ports) > 0 error_message = "Ports must be between 1024 and 65535." } }

Answer

variable "allowed_ports" { type = list(number) validation { condition = contains(var.allowed_ports, 1024) && contains(var.allowed_ports, 65535) error_message = "Ports must be between 1024 and 65535." } }

Question 13

Your team maintains a shared Terraform configuration in a GitHub repository. A developer opens a pull request that changes the instance type of a production EC2 instance. You want the change to be automatically validated by running a speculative plan before any human reviews the code. Which HCP Terraform feature should you configure to achieve this?

Accepted Answer

VCS-driven speculative plans. VCS-driven speculative plans are automatically queued by HCP Terraform when a pull request is opened against a connected repository, running a plan without applying. This provides early feedback and validation before merge. Run Triggers orchestrate runs between workspaces, CLI-driven runs are manual, and Sentinel policies only enforce rules during an existing run.

Answer

CLI-driven runs with remote backend

Answer

Run Triggers

Answer

Policy as Code with Sentinel

Question 14

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Accepted Answer

It provides state locking and run history. HCP Terraform (formerly Terraform Cloud) provides remote state management with built-in state locking and run history, which are critical for team collaboration. State locking prevents concurrent runs from corrupting the state file, while run history allows teams to audit changes and roll back if needed. These features are not available with local state, making HCP Terraform a superior choice for teams.

Answer

It converts HCL to JSON

Answer

It eliminates the need for AWS providers

Answer

It is always free

Question 15

A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?

Accepted Answer

terraform init -upgrade. The 'terraform init -upgrade' command forces Terraform to re-evaluate and download the latest versions of providers that meet the version constraints, even if a provider is already present in the local cache. This is the correct way to update providers or re-download a missing provider binary. It also updates the dependency lock file.

Answer

terraform plan -refresh-only

Answer

terraform providers install

Answer

terraform refresh

Question 16

You are building a module that needs to be consumed by multiple teams. How should you structure your module to ensure that the root module can provide values for variable definitions without hardcoding them in the module itself?

Accepted Answer

Define variables in a variables.tf file within the module directory.. Using input variables allows the module to be generic and reusable by accepting values defined in the calling configuration.

Answer

Hardcode the values into the resource blocks directly.

Answer

Use terraform.tfvars files inside the module folder.

Answer

Define all values in a locals.tf file within the module.

Question 17

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. HCP Terraform workspaces provide isolated environments for infrastructure management, each with its own state, variables, and run history. By using the same configuration files across multiple workspaces, you can deploy to development, staging, and production with environment-specific variables and separate state, achieving the required isolation. This is the standard pattern for multi-environment deployments in HCP Terraform.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 18

Which of the following is an advantage of using Variable Sets?

Accepted Answer

They centralize variable management to avoid duplication across workspaces.. Variable Sets allow you to define variables once and apply them across multiple workspaces, eliminating duplication and ensuring consistency. They are ideal for shared credentials, common tags, or provider configurations that many workspaces need. This centralization reduces drift and simplifies updates.

Answer

They allow for secret rotation in AWS.

Answer

They automatically run Terraform plans.

Answer

They provide encryption for state files.

Question 19

If a developer wants to use a provider that is not in the public registry, can they still use it?

Accepted Answer

Yes, by using a local registry or filesystem mirror.. Terraform supports provider installation from local filesystem mirrors or a local registry, not just the public Terraform Registry. A filesystem mirror is a directory containing provider packages in the expected layout, and a local registry can serve providers over HTTP. This allows developers to use custom or private providers without publishing them publicly.

Answer

No, only registry providers are supported.

Answer

Yes, by setting the env var TF_IN_AUTOMATION.

Answer

Yes, by recompiling Terraform binary.

Question 20

You have defined a resource and set 'prevent_destroy = true'. If you perform a 'terraform destroy', what will happen?

Accepted Answer

Terraform will return an error and abort the destroy operation.. When a resource has `prevent_destroy = true` in its lifecycle block, Terraform treats any plan that would destroy that resource as invalid. During `terraform destroy`, Terraform first generates a destroy plan; because that plan includes deleting the protected resource, Terraform immediately returns an error and aborts the entire operation before any resource is destroyed. This is a safety mechanism to prevent accidental deletion of critical infrastructure.

Answer

Terraform will destroy all resources except the one with the rule.

Answer

Terraform will ignore the rule and destroy the resource anyway.

Answer

Terraform will prompt for confirmation twice.