AWS provider Hard Questions — 25 Difficult Questions

Question 1

You want to pass a complex object type to a module, but you need to ensure specific attributes are present. How do you define this in the variable block?

Accepted Answer

type = object({...}). The object({...}) type constraint lets you define a schema with specific named attributes and their types, ensuring required attributes are present and correctly typed. This is the correct way to pass a complex object with enforced structure to a module. It validates at plan time and rejects missing or extra attributes as configured.

Answer

type = map(any)

Answer

type = list(object)

Answer

type = tuple([...])

Question 2

Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?

Accepted Answer

Create a Sentinel policy that uses the tfrun import to access the cost estimation data and enforce a hard-mandatory policy when the delta exceeds $500.. Cost estimation in HCP Terraform provides data that Sentinel policies can evaluate. By writing a hard-mandatory policy that checks the monthly cost delta from the cost estimate and fails if it exceeds $500, you enforce the compliance rule automatically for all runs in the finance project. This leverages the existing cost estimation feature and the policy-as-code framework.

Answer

Configure a run trigger from a cost monitoring workspace to the finance workspaces to automatically reject runs that exceed the threshold.

Answer

Enable the 'Cost Estimation' setting on each finance workspace and manually review the cost estimate before applying.

Answer

Set a workspace variable named COST_THRESHOLD to 500 and rely on Terraform's AWS provider to enforce it during plan.

Question 3

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. The 'terraform init' command is used to initialize a Terraform working directory, and when migrating from local state to HCP Terraform, it detects the backend configuration change and prompts to migrate the state. This is the standard command to set up the backend and perform the migration. Other commands are not used for this purpose.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 4

If you have a module that creates an S3 bucket, and you want the bucket name to be prefixed by a value provided by the caller, how do you achieve this?

Accepted Answer

Use string interpolation in the bucket name attribute.. Terraform modules accept input values through variables, and those values can be composed into resource attributes using string interpolation (or template strings). To prefix an S3 bucket name with a caller-supplied value, the module declares an input variable (e.g., variable "prefix") and the bucket resource uses something like bucket = "${var.prefix}-my-bucket" or the newer "${var.prefix}-my-bucket" template syntax. This is the idiomatic way to parameterize module resources.

Answer

Use a local variable that reads from the provider config.

Answer

Define the bucket name in the root module and override the child resource.

Answer

Use the 'module_name' variable provided by Terraform.

Question 5

When using 'replace_triggered_by', what happens if the referenced resource is deleted?

Accepted Answer

The plan fails because the dependency cannot be evaluated.. When 'replace_triggered_by' references a resource that has been deleted from configuration, Terraform cannot evaluate the dependency during plan, so the plan fails with an error about the referenced object not being found. The trigger requires a valid reference to an existing managed resource or attribute; a dangling reference breaks evaluation. This is by design — Terraform refuses to silently ignore a broken dependency.

Answer

The resource is destroyed as well.

Answer

The resource is kept as is.

Answer

The trigger is ignored.

Question 6

A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?

Accepted Answer

terraform init -upgrade. The 'terraform init -upgrade' command forces Terraform to re-evaluate and download the latest versions of providers that meet the version constraints, even if a provider is already present in the local cache. This is the correct way to update providers or re-download a missing provider binary. It also updates the dependency lock file.

Answer

terraform plan -refresh-only

Answer

terraform providers install

Answer

terraform refresh

Question 7

Which HCP Terraform feature allows you to manage infrastructure across multiple cloud accounts using a single organization?

Accepted Answer

Projects. HCP Terraform Projects allow you to organize workspaces and their associated infrastructure into logical groupings that can span multiple cloud accounts, all under a single organization. This feature provides a way to manage access control, policy enforcement, and cost allocation across different teams or environments without needing separate organizations. By using projects, you can delegate administration and apply consistent governance across disparate cloud accounts, which is exactly what the question describes.

Answer

Shared modules

Answer

Provider aliases

Answer

Remote execution

Question 8

You are using a dynamic block to define multiple 'tag' blocks inside an AWS resource. The dynamic block is failing because it expects a set of objects but receives a flat list. Which function best prepares your data?

Accepted Answer

toset(). `toset()` converts a list into a set, which is the collection type dynamic blocks expect when you want to iterate over unique elements without index-based ordering. If the dynamic block's `for_each` receives a flat list where a set of objects is required, wrapping it in `toset()` normalizes the type and removes duplicates. This is the idiomatic fix for type-mismatch errors in dynamic blocks.

Answer

keys()

Answer

distinct()

Answer

compact()

Question 9

If a developer wants to use a provider that is not in the public registry, can they still use it?

Accepted Answer

Yes, by using a local registry or filesystem mirror.. Terraform supports provider installation from local filesystem mirrors or a local registry, not just the public Terraform Registry. A filesystem mirror is a directory containing provider packages in the expected layout, and a local registry can serve providers over HTTP. This allows developers to use custom or private providers without publishing them publicly.

Answer

No, only registry providers are supported.

Answer

Yes, by setting the env var TF_IN_AUTOMATION.

Answer

Yes, by recompiling Terraform binary.

Question 10

Which TWO of the following are limitations of 'ignore_changes'?

Accepted Answer

It can be difficult to manage for deeply nested attributes.. Option A is correct because 'ignore_changes' in Terraform must reference attribute paths, and for deeply nested attributes you have to spell out the full path (for example, using index or key syntax like tags["Name"] or nested block paths), which becomes verbose and error-prone as nesting grows. Option B is correct because 'ignore_changes' only suppresses diffs on specified attributes within a resource; it cannot ignore a change to the resource type itself, since changing the type means replacing the resource block and Terraform will plan to destroy and recreate it. Option C is incorrect because 'ignore_changes' is a core Terraform lifecycle meta-argument and works with all providers, not just AWS. Option D is incorrect because you can list any subset of attributes to ignore, not all of them. Option E is incorrect because 'ignore_changes' works with complex types such as lists, maps, and nested blocks, not only primitive types.

Answer

It is only compatible with the AWS provider.

Answer

It requires all attributes to be ignored.

Answer

It only works with primitive types.

Question 11

During a refactor, an engineer renames the Terraform address of an aws_s3_bucket from aws_s3_bucket.logs to aws_s3_bucket.audit_logs in the configuration, keeping every argument identical. The bucket holds production logs. What is the safest way to apply this change without destroying and recreating the bucket?

Accepted Answer

Run terraform state mv aws_s3_bucket.logs aws_s3_bucket.audit_logs, then run terraform plan to confirm no changes.. Renaming a resource address changes only the identifier in configuration and state, not the underlying object. terraform state mv updates the state entry to match the new address so no destroy or create is planned, and a follow-up plan verifies the migration. Import creates duplicates, prevent_destroy blocks the apply, and -replace deliberately destroys the bucket.

Answer

Add lifecycle { prevent_destroy = true } to the renamed resource, then apply so Terraform refuses to delete the original bucket.

Answer

Use terraform apply -replace=aws_s3_bucket.audit_logs so Terraform rebuilds the bucket under the new name without data loss.

Answer

Run terraform import aws_s3_bucket.audit_logs with the bucket name, then delete the old resource block from configuration.

Question 12

A configuration defines a dynamic block that generates ingress rules for an aws_security_group from a list of objects. Each object has a from_port, to_port, and protocol attribute, and one object also carries an extra cidr_blocks list. You want every generated rule to include the from_port, to_port, and protocol values, and to include cidr_blocks only when it is present, without writing a separate block for the odd entry. Which approach satisfies this?

Accepted Answer

Add a nested dynamic "cidr_blocks" block inside the ingress content, iterating over rule.value.cidr_blocks with for_each and guarding the iteration with a conditional that yields an empty list when the attribute is null.. A nested dynamic block whose for_each source is guarded by a conditional that returns an empty list when the attribute is null produces inner blocks only for entries that actually carry cidr_blocks, while the outer content always emits the required scalar arguments. This keeps one uniform ingress block definition that adapts to heterogeneous input.

Answer

Declare the variable as a list of maps and rely on Terraform to supply empty defaults for any map keys that are absent.

Answer

Use content with from_port = rule.value.from_port and reference cidr_blocks = rule.value.cidr_blocks inside the same content block.

Answer

Set the iterator argument to a custom label and reference the custom label inside content for all attributes, including cidr_blocks.

Question 13

Your organization uses HCP Terraform with the AWS provider. A Sentinel policy set is attached to the 'production' project with a soft-mandatory policy that checks for required tags on all AWS resources. During a run, the policy fails because a developer forgot to add a 'CostCenter' tag to an EC2 instance. What is the outcome of the run, and what can the developer do?

Accepted Answer

The run is paused, and a user with permission to override policies can choose to override the failure and continue the apply.. A soft-mandatory Sentinel policy failure pauses the run and requires an authorized user to override the failure before the apply can proceed. This provides a balance between enforcement and flexibility, allowing developers to address issues or override when justified. The developer can override if they have the necessary permissions, and the run will then continue.

Answer

The run continues automatically but logs a warning, and the apply proceeds without any intervention.

Answer

The run fails immediately and cannot be overridden; the developer must modify the configuration and push a new commit.

Answer

The run is paused, and an organization owner must approve an override before the apply can proceed.

Question 14

If a module has a required variable but you do not provide it in the calling configuration, what happens?

Accepted Answer

Terraform fails with an error during the planning phase.. If a module declares a variable without a default and the calling configuration does not supply a value, Terraform raises an error during the planning phase, stating that the required variable has not been set. Terraform does not invent a value or fall back to prior state. This fail-fast behavior ensures module contracts are honored.

Answer

Terraform uses 'null' for the value.

Answer

Terraform uses the variable value from the previous state.

Answer

Terraform automatically sets the value to an empty string.

Question 15

How can you view the detailed breakdown of cost estimates for a specific Terraform plan?

Accepted Answer

Open the run page in the HCP Terraform UI.. The run details page in the HCP Terraform UI displays the cost estimation summary, which can be expanded for details.

Answer

Run the 'terraform show' command on the state file.

Answer

Check the cloud provider's billing dashboard.

Answer

Use the Sentinel CLI tool.

Question 16

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Accepted Answer

The policy attempts to access cost data before the estimation has completed.. Cost estimation in Terraform Cloud runs asynchronously after the plan. If a Sentinel policy references cost data (e.g., 'tfrun.cost_estimate') before the estimation has completed, the policy will fail because the data is not yet populated. This is the most likely cause when cost estimation is enabled but the policy still fails.

Answer

The cost estimation provider is not configured for AWS.

Answer

The workspace does not have Sentinel enabled.

Answer

The API key for AWS is invalid.

Question 17

Which TWO of the following are valid ways to pass a provider configuration to a child module?

Accepted Answer

Using the 'providers' meta-argument inside the module block.. Option B is correct because Terraform supports the 'providers' meta-argument inside a module block, which explicitly maps a provider configuration from the parent (root) module to a specific provider alias expected by the child module, e.g. 'providers = { aws = aws.usw2 }'. Option E is correct because Terraform automatically inherits the default (unaliased) provider configurations from the root module into child modules, so a child module using 'aws' without its own provider block receives the root's default AWS provider configuration. Option A is not a way to pass a configuration from the parent; defining a provider inside the module's main.tf creates a separate provider configuration local to the module rather than passing one in. Option C is invalid because provider configurations are complex objects, not strings, and cannot be supplied via input variables. Option D is invalid because Terraform has no concept of a 'global variable' for provider credentials; credentials belong in provider blocks or environment variables, not a global variable mechanism.

Answer

Defining the provider inside the module's 'main.tf'.

Answer

Passing the provider as a string input variable.

Answer

Using a global variable for provider credentials.

Question 18

What happens if you set 'ignore_changes = all' in a resource lifecycle block?

Accepted Answer

It causes Terraform to ignore all changes to the resource attributes.. Setting ignore_changes = all in a lifecycle block tells Terraform to ignore all attribute changes for that resource, so drift or configuration changes to attributes will not trigger updates. Terraform still manages the resource's existence, creating or destroying it as needed, but it will not modify attributes. This is useful for resources managed partly outside Terraform.

Answer

It disables the prevent_destroy rule.

Answer

It ignores the resource existence entirely.

Answer

It causes a syntax error.

Question 19

A platform engineer is preparing a Terraform configuration that will run in an environment where the AWS provider must be pinned to a specific minor version, and the provider must be sourced from the public Terraform Registry. The engineer also wants to ensure that `terraform init` records the selected version and checksums for later verification. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Add a `required_providers` block in the `terraform` block specifying the AWS provider with a `source` of `hashicorp/aws` and a version constraint such as `~> 5.40.0`.. Declaring the AWS provider in `required_providers` with a `~>` version constraint pins the minor version and confirms the public registry source, while committing the generated lock file preserves the exact version and checksums for reproducible, verified installs. Together these actions enforce version discipline and integrity across runs.

Answer

Add a `provider "aws"` block with a `version` argument set to the desired minor version.

Answer

Set the `TF_CLI_CONFIG_FILE` environment variable to point at a file that contains the provider version constraint.

Answer

Run `terraform providers lock -platform=linux_amd64` to generate checksums for all platforms.

Question 20

An `aws_instance` resource has `lifecycle { ignore_changes = [ami] }`. A security team updates the AMI ID in the Terraform configuration to a new hardened image. The instance is currently running an older AMI. What does Terraform plan for this resource during the next `terraform apply`?

Accepted Answer

Terraform reports no changes for the `ami` attribute and leaves the instance as-is.. The ignore_changes lifecycle argument filters out differences for the named attributes when Terraform compares configuration to state. When ami is ignored, a new AMI ID in configuration produces no planned change, so the instance is not replaced and no update is attempted. This is useful for attributes managed outside Terraform, but it also means security-driven AMI updates require removing the ignore entry first.

Answer

Terraform replaces the instance with one built from the new AMI.

Answer

Terraform updates the instance in place to the new AMI without replacement.

Answer

Terraform fails the plan with an error because the AMI differs from state.