AWS provider Terraform Modules Practice Test 4 — 15 Questions

Question 1

You are using a module from the public Terraform Registry in a production configuration. After running terraform init -upgrade, you notice that the module version changed unexpectedly and caused a breaking change in your infrastructure. You want to prevent this from happening again. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pin the module to a specific version using the version argument in the module block.. Pinning the module to a specific version using the version argument ensures that Terraform always uses that exact version, preventing unexpected upgrades that could introduce breaking changes. While other methods like local copies or avoiding -upgrade might reduce risk, they do not provide the same level of control and are not enforced by Terraform. The version argument is the recommended and reliable way to lock a module version.

Answer

Run terraform init without the -upgrade flag after the initial installation.

Answer

Set the version argument to a range like ">= 1.0.0" to allow flexibility while avoiding major version changes.

Answer

Use a local path to a copy of the module that you maintain manually.

Question 2

A platform team maintains a shared module in a private Terraform registry. They want to ensure that any configuration consuming this module always pulls the exact same version, even if a newer version is published. The module source is specified as "app.terraform.io/example-corp/vpc/aws". Which source argument change should be applied?

Accepted Answer

Add a version argument to the module block, e.g., version = "1.2.0".. Registry modules require a version argument within the module block to select a specific release. By setting version = "1.2.0", the consumer always retrieves that exact version, preventing unintended upgrades. Other methods such as query parameters or environment variables are not supported for registry modules and would not enforce version pinning. This is the standard practice for reproducible deployments.

Answer

Use a Git-style ref in the source string, such as ?ref=1.2.0.

Answer

Append ?version=latest to the source string to pin the latest version.

Answer

Set the environment variable TF_MODULE_VERSION to 1.2.0 before running terraform init.

Question 3

Your team maintains a Terraform module that provisions an AWS VPC. The module is used by multiple teams. You need to allow callers to customize the CIDR block but enforce a default if not provided. How should you define the variable in the module?

Accepted Answer

variable "vpc_cidr" { type = string default = "10.0.0.0/16" }. To allow callers to customize a value while providing a fallback, you define a variable with a default. The default is used only when the caller does not supply a value. This provides flexibility and ensures the module works even if the variable is omitted. The other options either make the variable required or do not provide a valid default.

Answer

variable "vpc_cidr" { type = string }

Answer

variable "vpc_cidr" { type = string default = null }

Answer

variable "vpc_cidr" { type = string validation { condition = can(cidrhost(var.vpc_cidr, 0)) error_message = "Invalid CIDR" } }

Question 4

You are updating a shared Terraform module that provisions an Amazon RDS instance. The module currently defines an input variable `engine_version` with `default = "14.7"`. Your team wants to ensure that any consumer who does not explicitly set `engine_version` still gets a valid value, but you also want to prevent consumers from accidentally passing a null value that would cause an API error. Which change should you make to the variable definition?

Accepted Answer

Add `nullable = false` to the variable block so Terraform rejects null values and uses the default instead.. The `nullable` argument, introduced in Terraform 1.1, controls whether a variable can be set to null. When `nullable = false`, a null value passed by a caller is treated as if the variable were omitted, so the default is used. This is the precise mechanism for ensuring a fallback to the default while still allowing callers to omit the variable.

Answer

Add a validation block that checks `var.engine_version != null` and returns an error message if the value is null.

Answer

Use a `sensitive = true` attribute on the variable to mask null values and fall back to the default.

Answer

Remove the default and mark the variable as required so callers must always provide a value.

Question 5

A platform team publishes a shared networking module to a private Terraform registry. Several consuming teams pin the module using `version = "~> 2.1.0"`. The platform team later adds a new optional input variable to the module and publishes it as version 2.2.0 without changing any existing behavior. What is the effect on the consuming teams' next `terraform init`?

Accepted Answer

terraform init continues using the newest 2.1.x version satisfying the constraint and does not select 2.2.0.. The pessimistic constraint operator restricts acceptable versions to a defined range. For `~> 2.1.0`, the upper bound is exclusive at 2.2.0, so the newly published 2.2.0 is invisible to consumers. Terraform installs the highest version that still satisfies the constraint, leaving teams on the latest 2.1.x release until they deliberately broaden the constraint.

Answer

terraform init fails because the version constraint does not allow patch-level upgrades.

Answer

terraform init prompts for confirmation before upgrading across minor versions, then proceeds if approved.

Answer

terraform init upgrades the module to 2.2.0 because adding an optional variable is a non-breaking change.

Question 6

A module author wants to conditionally create an AWS CloudWatch log group only when a variable named enable_logging is true. The log group resource is defined inside a child module. Which approach correctly implements this conditional creation within the module?

Accepted Answer

Use a count meta-argument on the resource with count = var.enable_logging ? 1 : 0.. Conditional resource creation in Terraform is achieved using the count or for_each meta-arguments. Applying count = var.enable_logging ? 1 : 0 directly on the resource allows it to be created only when the variable is true. This pattern works inside modules and is the idiomatic way to conditionally manage resources. Other methods like dynamic blocks or lifecycle arguments do not control resource existence.

Answer

Add a lifecycle block with create_before_destroy = var.enable_logging.

Answer

Use a null_resource with a trigger that runs a local-exec provisioner to create the log group via AWS CLI.

Answer

Wrap the resource in a dynamic block with for_each = var.enable_logging ? [1] : [].

Question 7

You maintain a Terraform module that provisions an AWS Application Load Balancer and its target groups. Consumers frequently need to attach additional security groups to the ALB, but the module currently hardcodes a single security group. You want to allow consumers to supply a list of security group IDs without breaking existing module calls. Which change should you make to the module's variables and resource configuration?

Accepted Answer

Add a new variable `additional_security_group_ids` of type `list(string)` with a default of `[]`, then merge it with the module's internally created security group ID using `concat()` in the `security_groups` argument.. Adding an optional input variable with a sensible default and composing it with the module's internal resource preserves backward compatibility. Existing consumers continue to work unchanged, while new consumers can pass extra security group IDs. Concatenating the internally managed security group with the additional ones ensures the ALB retains its baseline security posture and gains the requested extra groups.

Answer

Add a new variable `security_group_ids` of type `list(string)` with no default, and replace the existing hardcoded security group with this variable.

Answer

Use the `for_each` meta-argument on the `aws_lb` resource to iterate over a map of security group IDs provided by the consumer.

Answer

Change the existing `security_group_id` variable to type `list(string)` and update the `security_groups` argument to reference it directly.

Question 8

You are developing a Terraform module that creates an AWS EC2 instance. You want to expose the instance's private IP address to the caller. How should you define this in the module?

Accepted Answer

Add an output block in the module that references the instance's private_ip attribute.. Outputs are the mechanism for a module to return values to its caller. By defining an output that references the EC2 instance's private_ip attribute, the parent module can access it using module... This is the intended and most efficient way to expose resource attributes from a child module. Other options either do not work or are overly complicated.

Answer

Define a local value in the module and reference it in the root module.

Answer

Use a variable in the module to pass the private IP address to the caller.

Answer

Use a data source in the root module to look up the EC2 instance by its tags.

Question 9

An operations engineer maintains a module that creates an AWS RDS instance. The module block in the root configuration includes a `providers` argument mapping the module's `aws` provider to an aliased provider configuration targeting a secondary region. A new resource is added inside the module that uses `aws.global` as an explicit provider. What happens when the engineer runs `terraform plan`?

Accepted Answer

Terraform errors because the module only received a mapping for the default `aws` configuration, so `aws.global` has no configuration passed in.. Modules receive provider configurations only through explicit `providers` mappings in the module block. When a resource inside the module references an aliased provider such as `aws.global`, that alias must have been passed in. Because the root only supplied the default `aws` configuration, the alias is undefined inside the module and planning fails with an error about the missing provider configuration.

Answer

Terraform automatically inherits the root module's `aws.global` provider configuration for the child module.

Answer

Terraform errors because the module does not declare `aws.global` in its required_providers block.

Answer

Terraform silently falls back to the default `aws` provider configuration in the child module and plans successfully.

Question 10

A team is designing a reusable Terraform module that provisions an AWS VPC. They want to ensure the module is flexible and follows best practices for input variables. Which two practices should they implement? (Choose two.)

Accepted Answer

Mark variables that contain sensitive information with sensitive = true.. Marking sensitive variables with sensitive = true and using validation blocks are both best practices for reusable modules. Sensitivity prevents secret leakage, while validation enforces input constraints and improves error handling. Avoiding defaults for critical variables, using explicit types, and documenting variables are also important. These practices collectively make the module more secure, robust, and user-friendly.

Answer

Provide default values for all input variables to simplify usage.

Answer

Avoid documenting variables in README to keep the module concise.

Answer

Define all variables as type = any to maximize flexibility.

Question 11

You are authoring a module that creates an AWS RDS instance. The module must enforce that the `engine` input is one of `mysql`, `postgres`, or `mariadb`. A consumer passes `engine = "aurora"`. What is the most appropriate way to handle this in the module to provide a clear error message and enforce the constraint?

Accepted Answer

Use a `validation` block inside the `variable "engine"` declaration with a `condition` that checks `contains(["mysql", "postgres", "mariadb"], var.engine)` and an `error_message` describing the allowed values.. Variable validation blocks are the correct Terraform construct for enforcing constraints on input values. They run during plan and apply, produce a custom error message, and fail fast before any resources are provisioned. This gives module consumers immediate, actionable feedback and keeps invalid values from reaching the AWS provider or API.

Answer

Rely on the AWS provider's own validation of the `engine` argument, since the provider will reject invalid values when the API call is made.

Answer

Use a `locals` block to compute a boolean and then use the `count` meta-argument on the `aws_db_instance` resource to create zero instances when the engine is invalid.

Answer

Add a `precondition` block to the `aws_db_instance` resource that checks the engine value and fails if it is not in the allowed list.

Question 12

A module accepts a variable 'environment' used only to build a name prefix. The team wants to prevent callers from passing values outside a fixed set without duplicating validation in every caller. What is the correct approach?

Accepted Answer

Add a validation block inside the variable definition in the module. Validation blocks inside a variable definition enforce constraints at the point of declaration, so all callers are checked consistently and errors surface during plan. Preconditions, type constraints, and provisioners either require duplication, do not restrict values, or run too late to be reliable for this requirement.

Answer

Declare the variable with type = string and rely on callers to pass correct values

Answer

Use a precondition block on each resource that consumes the variable

Answer

Add a null_resource with a local-exec provisioner that validates the value at apply time

Question 13

You are writing a Terraform module that creates an AWS S3 bucket. You want to ensure that the bucket name is globally unique and follows a naming convention that includes the AWS account ID and region. How can you generate a unique name within the module?

Accepted Answer

Use the random_id resource to generate a unique suffix and append it to the bucket name.. The random_id resource generates a unique, stable identifier that can be used as a suffix to ensure global uniqueness. When combined with account ID and region, it creates a name that follows the convention and is highly unlikely to collide. Other methods like uuid() or timestamp() either do not guarantee uniqueness or cause instability in the name across runs.

Answer

Use the timestamp() function to generate a unique name based on the current time.

Answer

Use the format() function with the account ID and region, and rely on AWS to enforce uniqueness.

Answer

Use the uuid() function to generate a unique string and use it as the bucket name.

Question 14

A module outputs an AWS S3 bucket name. The root configuration needs to pass this output to another module as an input variable. How should the root configuration reference the output from the first module?

Accepted Answer

module.bucket.bucket_name. Module outputs are referenced using the module.. syntax. This allows the root configuration to consume values from child modules and pass them to other modules or resources. The other options refer to different constructs: output blocks declare root outputs, var references input variables, and terraform_remote_state accesses external state files. The correct syntax is module.bucket.bucket_name.

Answer

var.bucket.bucket_name

Answer

output.bucket.bucket_name

Answer

data.terraform_remote_state.bucket.bucket_name

Question 15

Your team publishes an internal Terraform module to a private registry. A consumer wants to pin the module to a specific version to avoid unexpected changes. The module source is `app.terraform.io/example-org/vpc/aws`. Which source argument correctly pins the module to version 2.3.0?

Accepted Answer

source = "app.terraform.io/example-org/vpc/aws" version = "2.3.0". Registry modules require the version argument to be set separately from the source string. Pinning to an exact version such as "2.3.0" ensures that the same module code is used across all runs, which is critical for reproducibility and preventing unintended changes. The source format for a registry module is hostname/namespace/name/provider without any version embedded.

Answer

source = "git::https://app.terraform.io/example-org/vpc/aws.git?ref=v2.3.0"

Answer

source = "app.terraform.io/example-org/vpc/aws/2.3.0"

Answer

source = "app.terraform.io/example-org/vpc/aws?version=2.3.0"