AWS provider Collaborative Workflows — 15 Questions

Question 1

Which protocol does HCP Terraform use to communicate with Terraform CLI?

Accepted Answer

HCP Terraform API. Terraform uses the 'Terraform Cloud API' for all communication between the CLI and HCP Terraform.

Answer

gRPC

Answer

FTP

Answer

SSH

Question 2

You have a team-based collaboration project. Where should you store sensitive credentials like AWS secret keys so they are not hardcoded in your Terraform files?

Accepted Answer

In environment variables marked as 'sensitive'. HCP Terraform variables marked as 'sensitive' are stored securely and never displayed in the UI.

Answer

In a .tfvars file

Answer

In a version-controlled .env file

Answer

In the state file

Question 3

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Accepted Answer

To access resources in a private network. Agents allow Terraform to run in a private network, accessing resources that are not reachable from the public internet.

Answer

To increase execution speed

Answer

To bypass OPA policies

Answer

To avoid paying for HCP Terraform

Question 4

You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?

Accepted Answer

input.resource_changes. In OPA/Sentinel, you access the plan data structure which contains the resource changes and their associated attributes.

Answer

terraform.tags

Answer

state.output

Answer

var.tags

Question 5

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. 'terraform init' detects the backend configuration and initiates the migration process.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 6

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. Workspaces in HCP Terraform provide a way to maintain separate state files and variable sets for the same configuration.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 7

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The 'read' permission allows viewing runs and state without modification capabilities.

Answer

Write

Answer

Admin

Answer

Cost Estimation

Question 8

You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?

Accepted Answer

dynamodb_table. The 'dynamodb_table' parameter is used with the S3 backend to enable state locking, preventing concurrent operations.

Answer

workspace_key_prefix

Answer

kms_key_id

Answer

acl

Question 9

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

Accepted Answer

Configuring Run Triggers in the downstream workspace. Run triggers are configured in the downstream workspace settings to listen for successful outputs from an upstream workspace.

Answer

Enabling 'Auto-apply' in the upstream

Answer

Setting a 'TF_VAR' environment variable

Answer

Using a local variable

Question 10

Which organization-level setting in HCP Terraform governs who can create new workspaces?

Accepted Answer

Team permissions. Permissions for creating workspaces are managed via Organization Team permissions.

Answer

Global settings

Answer

Agent pool settings

Answer

Workspace settings

Question 11

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Accepted Answer

It provides state locking and run history. HCP Terraform provides centralized state management, locking, and a history of runs, which are critical for teams.

Answer

It converts HCL to JSON

Answer

It eliminates the need for AWS providers

Answer

It is always free

Question 12

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

Accepted Answer

Using -var flag in terraform apply. CLI-driven runs or API overrides can pass different variables to a specific run execution.

Answer

By editing the state file

Answer

By modifying the provider block

Answer

By adding a new workspace

Question 13

You need to enforce that only specific VM sizes are used in your infrastructure. Which Sentinel feature provides this capability?

Accepted Answer

Policy enforcement. Sentinel policies allow you to evaluate plan data and return a boolean decision to allow or block the plan.

Answer

Run trigger

Answer

Workspaces

Answer

Policy Set

Question 14

You have a Terraform configuration that uses a module from the public registry. How do you ensure your team uses a specific version?

Accepted Answer

Using the 'version' argument. The 'version' attribute within the 'source' block of the module ensures version pinning.

Answer

By manually deleting other versions

Answer

By configuring a Sentinel policy

Answer

Using a provider block

Question 15

When implementing OPA policies, what is the 'soft-mandatory' enforcement level?

Accepted Answer

It allows the run if overridden. Soft-mandatory policies can be overridden by users with sufficient permissions after a warning is issued.

Answer

It blocks the run completely

Answer

It is a deprecated feature

Answer

It only logs the event