AWS provider Quick Quiz — 10 Questions

Question 1

You need to share a module across your entire organization. Which registry type should you use?

Accepted Answer

A private module registry in Terraform Cloud or Enterprise.. A private module registry in Terraform Cloud or Enterprise is the correct answer because it is purpose-built for sharing Terraform modules within an organization. It provides versioned, discoverable modules with access control, integrates natively with Terraform CLI/Cloud workflows, and supports private module sourcing via the `terraform init` command. This ensures secure, consistent, and governed reuse across teams, which is exactly what the scenario requires.

Answer

The public Terraform Registry.

Answer

A shared network drive.

Answer

An S3 bucket with public read access.

Question 2

You want to pass a complex object type to a module, but you need to ensure specific attributes are present. How do you define this in the variable block?

Accepted Answer

type = object({...}). The object({...}) type constraint lets you define a schema with specific named attributes and their types, ensuring required attributes are present and correctly typed. This is the correct way to pass a complex object with enforced structure to a module. It validates at plan time and rejects missing or extra attributes as configured.

Answer

type = map(any)

Answer

type = list(object)

Answer

type = tuple([...])

Question 3

Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?

Accepted Answer

Create a Sentinel policy that uses the tfrun import to access the cost estimation data and enforce a hard-mandatory policy when the delta exceeds $500.. Cost estimation in HCP Terraform provides data that Sentinel policies can evaluate. By writing a hard-mandatory policy that checks the monthly cost delta from the cost estimate and fails if it exceeds $500, you enforce the compliance rule automatically for all runs in the finance project. This leverages the existing cost estimation feature and the policy-as-code framework.

Answer

Configure a run trigger from a cost monitoring workspace to the finance workspaces to automatically reject runs that exceed the threshold.

Answer

Enable the 'Cost Estimation' setting on each finance workspace and manually review the cost estimate before applying.

Answer

Set a workspace variable named COST_THRESHOLD to 500 and rely on Terraform's AWS provider to enforce it during plan.

Question 4

Which command helps verify if the providers are properly initialized?

Accepted Answer

terraform providers. 'terraform providers' lists all providers required by the configuration, confirming they are initialized.

Answer

terraform validate

Answer

terraform show

Answer

terraform plan

Question 5

Which TWO of the following are valid uses of the 'for' expression?

Accepted Answer

Generating a list. In Terraform, the 'for' expression is used to transform and produce collection values: option B is correct because a 'for' expression over a list or set returns a tuple/list, e.g. [for s in var.subnets : upper(s)], which generates a list. Option E is correct because using the curly-brace form, e.g. {for k, v in var.tags : k => upper(v)}, produces a map (object) of key-value pairs. Option A is not a use of 'for' because resources are declared with a 'resource' block, not an expression. Option C is wrong because provider configuration is handled by 'provider' blocks and required_providers, not 'for'. Option D is wrong because dynamic blocks are created with the 'dynamic' block and its 'for_each' argument, not with a 'for' expression.

Answer

Defining a resource

Answer

Managing provider blocks

Answer

Creating dynamic blocks

Question 6

When a resource is marked as 'tainted', what is the expected outcome of the next 'terraform apply'?

Accepted Answer

It is destroyed and recreated.. A tainted resource is one Terraform has marked as degraded or partially created, so the next 'terraform apply' will destroy the existing object and create a fresh replacement. This is the standard recovery mechanism when a resource is in an unhealthy or unknown state but you want to keep it managed by Terraform.

Answer

It is ignored.

Answer

It is removed from the state file.

Answer

It is updated in place.

Question 7

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. The 'terraform init' command is used to initialize a Terraform working directory, and when migrating from local state to HCP Terraform, it detects the backend configuration change and prompts to migrate the state. This is the standard command to set up the backend and perform the migration. Other commands are not used for this purpose.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 8

Which TWO of the following are standard stages of an HCP Terraform run pipeline?

Accepted Answer

Policy Check.. Option A (Policy Check) is correct because HCP Terraform's run pipeline includes a Policy Check stage where Sentinel or OPA policies are evaluated against the plan before it can be applied, enforcing governance and compliance. Option C (Plan) is correct because the Plan stage is a core phase of every run, where Terraform generates an execution plan comparing the current state to the desired configuration. The pipeline stages are typically Plan, Policy Check, and Apply, so these two fit the standard sequence. Option B (Code linting) is not a pipeline stage; linting is done externally by tools like tflint or pre-commit hooks, not by HCP Terraform's run workflow. Option D (Automatic refactoring) is not a feature of the run pipeline; Terraform does not automatically rewrite configurations. Option E (State migration) is not a pipeline stage; state migration occurs when changing backends or workspaces, not as a standard run phase.

Answer

Code linting.

Answer

Automatic refactoring.

Answer

State migration.

Question 9

If a user wants to ensure that a resource's lifecycle is managed by Terraform but wants to bypass the 'prevent_destroy' protection, what is the best approach?

Accepted Answer

Remove the prevent_destroy block from the configuration and apply.. The prevent_destroy lifecycle meta-argument is a configuration-level protection, not a state-level one. To bypass it, you must edit the configuration to remove (or comment out) the prevent_destroy argument from the lifecycle block, then run terraform apply so the plan reflects the new configuration. Only after the argument is gone from the config can terraform destroy proceed against that resource.

Answer

Add 'ignore_changes = [prevent_destroy]' to the block.

Answer

Use 'terraform state rm' to remove the constraint.

Answer

Use 'terraform destroy -force-remove-prevent-destroy'.

Question 10

Which of the following is a primary benefit of using a Private Module Registry?

Accepted Answer

It allows central management and version control of reusable modules.. A Private Module Registry (available in Terraform Cloud/Enterprise and as a self-hosted registry) provides a centralized, versioned catalog of reusable modules that teams can publish, discover, and consume. It enforces versioning and access control, so consumers pin module versions and get consistent, auditable infrastructure patterns across the organization. This is its primary benefit over ad-hoc Git-based module sourcing.

Answer

It encrypts all Terraform state files.

Answer

It forces all workspaces to use the same module versions.

Answer

It automatically generates cost estimates for all modules.