If you have a module that creates an S3 bucket, and you want the bucket name to be prefixed by a value provided by the caller, how do you achieve this?
Your team maintains a Terraform module that provisions an AWS VPC. The module currently accepts a single string variable `cidr_block` for the VPC CIDR. You need to extend the module to support multiple CIDR blocks (e.g., for additional subnets), but you must not break existing callers that pass a single string. Which approach allows existing callers to continue working without modification while enabling the new capability?
A team wants to consume a module from a Git repository at a specific commit for reproducibility. Which two source address forms are valid and reproducible for this purpose? (Choose two.)
You maintain a module that creates an AWS Lambda function. The module exposes an output `function_arn` that is derived from the `aws_lambda_function` resource. A consumer wants to use this output in another module, but they need the value to be available even before the Lambda function is created, for planning purposes. What should you do to the output definition to satisfy this requirement?
You are authoring a module that creates an AWS EC2 instance and an associated security group. The module should allow the caller to optionally provide a list of additional security group IDs to attach to the instance. If the caller does not provide any, the instance should use only the security group created within the module. Which variable declaration and usage pattern correctly implements this optional behavior?
Your team maintains a Terraform module that provisions an AWS VPC and subnets. The module is consumed by multiple environments. You need to ensure that any future changes to the module's implementation do not break existing deployments unless explicitly upgraded. Which version constraint syntax should you use in the module block?
A team wants to distribute an internal Terraform module that is stored in an Amazon S3 bucket. The bucket is in the `us-east-1` region and contains the file `modules/vpc.zip`. Which source string correctly references this module in a `module` block?
You are creating a Terraform module that will be used by multiple teams. You want to ensure that the module is robust and follows best practices for input variables. Which two actions should you take? (Choose two.)
You are developing a module that creates an AWS Lambda function. The module should allow the caller to optionally provide a dead-letter queue (DLQ) ARN. If provided, the Lambda function should be configured with that DLQ; if not, no DLQ should be set. Which Terraform expression correctly conditionally sets the `dead_letter_config` argument?
You are using a module from the Terraform Registry that provisions an AWS RDS instance. The module requires a subnet group and security group IDs. You want to pass these from resources created in your root configuration. How should you define the module block to ensure proper dependency ordering?
Your team maintains a Terraform module that provisions an AWS Application Load Balancer (ALB) and its target groups. The module is stored in an internal Git repository and is consumed by several product teams. A product team reports that after you updated the module to add a new required variable `certificate_arn`, their `terraform plan` fails with an error about an unsupported argument. They are using the module source `git::ssh://git@internal.example.com/infra/alb-module.git?ref=v2.1.0`. You want to make the variable optional for existing consumers without changing the module's major version. What should you do?
When refactoring a large infrastructure configuration, you move a resource into a child module. How do you handle the existing state to prevent Terraform from destroying and recreating the resource?
Your team requires a custom module to be versioned strictly to prevent breaking changes during deployments. What is the recommended way to reference a module from a private Git repository?
You are building a module that needs to be consumed by multiple teams. How should you structure your module to ensure that the root module can provide values for variable definitions without hardcoding them in the module itself?
A platform team maintains a module that provisions a VPC and subnets. They want to expose the subnet IDs to callers without allowing callers to modify them. Which Terraform construct should they use in the module?
A module uses for_each over a map to create several IAM roles, and the map keys are derived from a variable that callers may change. The team wants to avoid replacing roles when only the map's values change. Which change to the module is required?
You are using a module from the public Terraform Registry in a production configuration. After running terraform init -upgrade, you notice that the module version changed unexpectedly and caused a breaking change in your infrastructure. You want to prevent this from happening again. Which approach should you take?
A platform team maintains a shared module in a private Terraform registry. They want to ensure that any configuration consuming this module always pulls the exact same version, even if a newer version is published. The module source is specified as "app.terraform.io/example-corp/vpc/aws". Which source argument change should be applied?
Your team maintains a Terraform module that provisions an AWS VPC. The module is used by multiple teams. You need to allow callers to customize the CIDR block but enforce a default if not provided. How should you define the variable in the module?
You are updating a shared Terraform module that provisions an Amazon RDS instance. The module currently defines an input variable `engine_version` with `default = "14.7"`. Your team wants to ensure that any consumer who does not explicitly set `engine_version` still gets a valid value, but you also want to prevent consumers from accidentally passing a null value that would cause an API error. Which change should you make to the variable definition?
A platform team publishes a shared networking module to a private Terraform registry. Several consuming teams pin the module using `version = "~> 2.1.0"`. The platform team later adds a new optional input variable to the module and publishes it as version 2.2.0 without changing any existing behavior. What is the effect on the consuming teams' next `terraform init`?
A module author wants to conditionally create an AWS CloudWatch log group only when a variable named enable_logging is true. The log group resource is defined inside a child module. Which approach correctly implements this conditional creation within the module?
You maintain a Terraform module that provisions an AWS Application Load Balancer and its target groups. Consumers frequently need to attach additional security groups to the ALB, but the module currently hardcodes a single security group. You want to allow consumers to supply a list of security group IDs without breaking existing module calls. Which change should you make to the module's variables and resource configuration?
You are developing a Terraform module that creates an AWS EC2 instance. You want to expose the instance's private IP address to the caller. How should you define this in the module?
An operations engineer maintains a module that creates an AWS RDS instance. The module block in the root configuration includes a `providers` argument mapping the module's `aws` provider to an aliased provider configuration targeting a secondary region. A new resource is added inside the module that uses `aws.global` as an explicit provider. What happens when the engineer runs `terraform plan`?
A team is designing a reusable Terraform module that provisions an AWS VPC. They want to ensure the module is flexible and follows best practices for input variables. Which two practices should they implement? (Choose two.)
You are authoring a module that creates an AWS RDS instance. The module must enforce that the `engine` input is one of `mysql`, `postgres`, or `mariadb`. A consumer passes `engine = "aurora"`. What is the most appropriate way to handle this in the module to provide a clear error message and enforce the constraint?
A module accepts a variable 'environment' used only to build a name prefix. The team wants to prevent callers from passing values outside a fixed set without duplicating validation in every caller. What is the correct approach?
You are writing a Terraform module that creates an AWS S3 bucket. You want to ensure that the bucket name is globally unique and follows a naming convention that includes the AWS account ID and region. How can you generate a unique name within the module?
A module outputs an AWS S3 bucket name. The root configuration needs to pass this output to another module as an input variable. How should the root configuration reference the output from the first module?
Your team publishes an internal Terraform module to a private registry. A consumer wants to pin the module to a specific version to avoid unexpected changes. The module source is `app.terraform.io/example-org/vpc/aws`. Which source argument correctly pins the module to version 2.3.0?
You are writing a module that creates an AWS Security Group. The module accepts a variable `ingress_rules` defined as a list of objects with `from_port`, `to_port`, and `protocol`. You want to ensure that the module's interface is flexible enough to allow callers to add or remove rules without modifying the module code. Which Terraform feature should you use to iterate over the list and create dynamic ingress blocks?
You are creating a Terraform module that will be used by multiple teams. You want to ensure that the module is reusable and maintainable. Which TWO practices should you follow when designing the module's interface? (Choose two.)
You are writing a reusable module that creates an AWS S3 bucket and an associated bucket policy. The module will be consumed by multiple teams. Which TWO practices should you follow to make the module robust and maintainable? (Choose two.)
You are refactoring a module that previously used `count` to create multiple AWS IAM users. The module now uses `for_each` with a map of usernames to user details. After the refactor, you run `terraform plan` and see that Terraform wants to destroy and recreate all existing IAM users. What is the most likely cause, and how can you avoid this disruption?
You are designing a reusable Terraform module that will be consumed by multiple teams. To ensure the module is maintainable and follows best practices, which TWO of the following should you implement? (Choose two.)
You have a root module that calls a child module to create an AWS VPC. The child module defines an output named `vpc_id`. After running `terraform apply`, where can you find the value of `vpc_id`?
You are developing a module that creates an AWS Lambda function. The module accepts a variable `environment` and must set the Lambda function's `environment` block with variables `LOG_LEVEL` and `STAGE`. The values for these should be derived from the `environment` variable. How should you define the variable and use it within the module?
A module author wants to prevent callers from accidentally overriding a critical naming convention. The module already computes a `bucket_name` local. The author wants to expose it to callers without allowing them to set it. Which approach correctly enforces this behavior?
You have a module `terraform-aws-modules/vpc/aws` version `3.14.0` from the public Terraform Registry. You want to ensure that your configuration always uses this exact version and does not automatically upgrade to newer versions. Which version constraint should you specify in the module block?
A platform team is preparing a reusable module for internal distribution. They want to ensure that consumers can reliably upgrade the module without unexpected breaking changes. Which TWO practices best support this goal? (Choose two.)
You have written a Terraform module that outputs the ARN of an AWS S3 bucket. A user of the module wants to reference this output in their root configuration. How should they access it?
You are writing a module that creates an AWS EC2 instance and an associated security group. The module has a variable `instance_type` with a default of `t3.micro`. A consumer wants to override this default for a production environment. How should the consumer pass a different value when calling the module?