HashiCorp Certified: Terraform Authoring and Operations Professional (AWS provider) (AWS provider) (AWS provider) — Questions 1–75

This declaration defines a required variable of type list(string). Since no default is provided, it is required. The type constraint ensures that only a list of strings is accepted, which is exactly what is needed for subnet IDs.

A run stalled at Policy Check usually means Sentinel cannot evaluate the policy set, often through misconfiguration or an execution error. Reviewing the policy set configuration and its execution logs identifies the blocking cause so the run can proceed.

Project Write permission allows a team to create and manage workspaces within the project, including running applies and managing workspace variables, but it does not permit deleting the project or changing project-level settings. This aligns exactly with the requirement to delegate workspace management without granting project administration rights.

Run Triggers let a downstream workspace watch specified upstream workspaces and queue a plan automatically once their apply succeeds. This directly satisfies the stem's requirement for automatic triggering, since no manual run or webhook scripting is needed.

The alias meta-argument creates a named, separate instance of a provider configuration, letting one module address multiple regions, accounts or endpoints of the same provider. Without it, only a single default configuration per provider could be declared.

VCS Triggers let you filter runs by file path patterns, so specifying the module path ensures a run triggers only when files within it change, satisfying the constraint of scoping runs to a specific module directory.

Relying on create_before_destroy duplicates dependent resources before the originals are removed, so unique names, tags, or quotas collide. This directly satisfies the stem's dependency-chain constraint: Terraform cannot sequence replacements, producing naming conflicts and resource contention during the overlap window.

The AWS provider automatically uses the default credential provider chain when no explicit credentials are set. This includes environment variables, shared credentials files, IAM roles for EC2 or ECS, and AWS SSO. Relying on this chain keeps secrets out of the configuration and state, and allows each environment to supply credentials through its native mechanism, satisfying portability and security.

The provider segment identifies which plugin Terraform must download, formatted as `namespace/type` (for example `hashicorp/aws`), and optionally constrains the version. It satisfies the stem's requirement by naming a mandatory component of the source address, alongside the hostname and module subdirectory, enabling correct registry resolution.

`terraform providers lock` records checksums for the platforms you name, so adding linux_amd64 lets CI verify the mirror's package against the lock file. Because the mirror only serves linux_amd64, this is the platform whose hashes must be present, and regenerating the file against the mirror captures the correct values.

This nested for expression first builds, for each environment, a list of names from 0 to count-1, then flattens the resulting list of lists into a single flat list. It correctly expands each environment's count into individual instance names, matching the required "<env>-<index>" format for use with for_each.

The provider meta-argument explicitly binds a resource block to a named provider configuration, such as aws.west, overriding the default instance. This satisfies the requirement to associate a resource with a non-default provider instance within the same configuration.

The CLI configuration file is `~/.terraformrc` on Unix-like systems and `terraform.rc` in the user's `%APPDATA%` directory on Windows. A `provider_installation` block there can define a `network_mirror` or `filesystem_mirror` source, optionally scoped to the `hashicorp/aws` provider, so only AWS resolves from the mirror while other providers continue from the public registry.

Because replace_triggered_by creates a dependency edge from the triggering resource to the replaced one, referencing resources that already depend on each other forms a cycle, which Terraform rejects during graph construction. Avoiding circular dependency loops is therefore mandatory for valid configuration.

Creating an OAuth application in the VCS provider is mandatory: HCP Terraform uses its OAuth client ID and secret to obtain authorisation tokens, letting it read repositories and register webhooks for automatic runs. Without this OAuth handshake, no VCS connection can be established.

Splitting an oversized module restores single responsibility, so each sub-module owns one concern and exposes a narrow interface. This directly resolves the stem's constraint of a module that has grown too large, cutting blast radius and making plans, reviews and reuse manageable.

Terraform prints root module outputs to the CLI after apply, and persists every output value in the state file for later retrieval. This satisfies the question's requirement that outputs appear in both locations, since child module outputs remain accessible via the state even when not displayed directly.

The lifecycle argument reverses Terraform's default destroy-then-create order, provisioning the replacement first so the old resource keeps serving traffic until the new one is ready. This directly satisfies the stem's downtime constraint, since the default ordering leaves a gap where no resource exists.

A tainted resource is marked for destruction and recreation on the next apply, so running terraform apply replaces it, satisfying the requirement to handle the taint. Terraform reads the taint flag from state and plans a destroy-then-create cycle without further intervention.

Private modules in HCP Terraform are referenced using the registry's hostname, namespace, module name, and provider, followed by a version constraint. This allows Terraform to fetch the specified version from the registry, ensuring consistency and leveraging registry features like versioning and access control.

A dynamic block iterates its for_each collection to generate nested blocks. When that collection is an empty set, the iterator produces zero iterations, so no nested blocks are rendered at all and the resource is created without them.

The providers map inside a module block passes a configured provider instance, aliased or default, into the child module, so the child uses the parent's configuration rather than instantiating its own. This satisfies explicit provider inheritance across module boundaries.

Specifying `version = "3.14.0"` without any operators pins the module to exactly that version. Terraform will not select any other version, ensuring consistency. This satisfies the requirement to always use the exact version and prevents automatic upgrades. It is the correct way to lock a module version in a module block.

Validation blocks allow you to enforce constraints on variable values, catching errors early. This improves module robustness and provides clear error messages to consumers. It is a best practice to validate critical inputs, such as ensuring CIDR blocks are valid or instance types are in an allowed list.

The source attribute gives the provider's registry address, such as registry.terraform.io/hashicorp/aws, telling Terraform where to resolve and download the plugin. This satisfies the requirement to identify the provider's origin rather than merely its local name or version constraint.

terraform state rm deletes the resource's entry from the state file only, leaving the real AWS infrastructure untouched. Subsequent plans no longer track it, which matches the stem's requirement to remove it from management without destroying it.

HCP Terraform policy sets enforce Sentinel or OPA policies against Terraform runs, evaluating planned EC2 instance types before apply. This blocks instance sizes exceeding t3.medium at the Terraform layer, satisfying the stem's requirement to prevent creation of larger instances.

Variable sets hold Terraform input variables, including sensitive and HCL values, which are then applied across every workspace the set is assigned to. This satisfies the scenario because Terraform variables are precisely the reusable input values a set distributes.

This meta-argument ensures that the replacement resource is created before the existing one is destroyed. It is specifically designed to reduce downtime during updates that force replacement. By setting it to true, Terraform will create the new EC2 instance first, then destroy the old one, achieving the desired behavior.

The Private Module Registry publishes a new module version when a semver release tag is pushed to the linked VCS repository. Tagging the commit triggers automatic publication, satisfying the stem's requirement to automate module publication without manual upload.

A local value is computed entirely inside the module and cannot be set by callers. Exposing it through an output makes the value available to the root configuration as a read-only reference, such as `module.vpc.bucket_name`. This achieves the goal of sharing the naming convention while structurally preventing any override.

A new commit creates a new run that enters the workspace queue while the current run finishes. This preserves an ordered history and prevents overlapping operations. Depending on workspace settings, an older queued run may later be discarded, but the in-flight run is not interrupted by default.

The `providers` argument maps a module's provider requirement to a specific provider configuration from the calling module, so three module blocks can each receive a differently aliased aws provider targeting a distinct region. This keeps the shared module region-agnostic and avoids duplicating its source.

Sentinel policies can evaluate the plan and run metadata, including variables. A policy set attached to the production project can inspect for AWS access key variables and reject runs that include them, directly enforcing the no-static-keys requirement while allowing OIDC-based credentials.

Sentinel policies in HCP Terraform are configured at the organization level via policy sets, which can be applied to all workspaces. This enforces governance centrally, ensuring every run that plans AWS resources is evaluated. The policy can inspect the plan for aws_security_group CIDR blocks and block non-compliant configurations, meeting the requirement without per-workspace configuration.

The provider_installation block with filesystem_mirror configures Terraform to install providers from a local directory. This is the correct way to use an offline mirror. The path points to a directory structured with provider packages, allowing terraform init to succeed without internet access.

`create_before_destroy` is a genuine Terraform lifecycle meta-argument, controlling replacement ordering so a new resource is provisioned before the old one is destroyed. It satisfies the stem's requirement for a valid lifecycle meta-argument, unlike `depends_on` (a meta-argument but not lifecycle-scoped) or `prevent_destroy` variants.

The identifier written directly after the module keyword is the local instance name, letting you reference outputs as module.<label>.<output>. It is not an argument inside the block; the block's source argument only supplies the module's location.

The command writes provider checksums into the dependency lock file for multiple platforms, securing the exact provider versions and their hashes. This satisfies the requirement to verify provider integrity across platforms, preventing tampering or unexpected version drift during init.

A validation block's condition argument must evaluate to true or false; Terraform reports the error_message when it returns false. This satisfies the stem's boolean requirement, since non-boolean expressions such as strings or numbers cannot be evaluated as pass/fail conditions.

In Terraform, outputs from a module are accessed using the syntax module.<MODULE_NAME>.<OUTPUT_NAME>. If the module is named bucket and it defines an output named bucket_name, the root configuration references it as module.bucket.bucket_name. This value can then be passed to another module's input variable. This is the standard way to chain modules.

Terraform identifies for_each instances by their map keys. If keys remain constant while values change, Terraform updates attributes in place rather than replacing resources. Stable keys are therefore the correct fix to prevent unnecessary role replacement.

Terraform's lifecycle `prevent_destroy` meta-argument causes the plan phase to fail whenever a destroy action targets that resource, so `terraform destroy` errors out and aborts before removing anything. This satisfies the stem's protection requirement, halting the entire operation rather than skipping the resource silently.

ignore_changes accepts attribute paths, and for deeply nested blocks or complex structures those paths become unwieldy and error-prone to maintain. This manageability constraint is the recognised limitation, not any effect on resource type or provider behaviour.

HCP Terraform enforces per-workspace run concurrency: a run acquires the workspace lock while it plans and applies, and a second run waits or is canceled rather than proceeding concurrently. This prevents two applies from corrupting remote state. The rejection the second engineer sees is the expected result of that lock, not a misconfiguration.

The version argument inside a module block pins the registry module to an exact or constrained release, such as 5.1.0. This satisfies the requirement that the team uses a specific version, preventing automatic upgrades to newer releases that could introduce breaking changes.

HCP Terraform stores state remotely and centrally, so every team member reads and writes the same authoritative state rather than local copies. This satisfies the benefit of eliminating drift and conflicts arising from scattered local state files across a team.

The `~>` pessimistic constraint operator permits patch and minor upgrades within major version 4, blocking the breaking changes that version 5 would introduce. Placing it inside `required_providers` within the `terraform` block satisfies the stem's requirement to pin a specific major version of the AWS provider.

When credentials must remain inside a controlled network boundary, running Terraform on a self-hosted agent keeps provider authentication traffic within that perimeter. Hosted runners would require the credentials to be usable from HashiCorp-operated infrastructure, which violates the stated policy, making an agent pool the appropriate choice.

Variable validation blocks are evaluated during plan and apply, and they produce a clear, custom error message when the condition is false. This enforces the constraint at the module boundary and gives consumers immediate feedback. It is the intended Terraform mechanism for validating input values and is evaluated before any resources are created, preventing invalid configurations from reaching AWS.

ignore_changes = [tags] tells Terraform to ignore any changes to the tags attribute of the EC2 instance. This means that if tags are modified outside of Terraform, the next plan will not show a diff for tags, and apply will not revert them. Other attributes remain managed, which aligns with the requirement to ignore only tags.

When no explicit iterator is declared, Terraform names the iterator object after the dynamic block's label itself, so a block labelled 'ingress' exposes each element as 'ingress.value'. This satisfies the default-label constraint without requiring an iterator argument.

Converting the list to a set with toset and using for_each creates one bucket per unique environment, keyed by the environment name itself. Because the keys are the values, reordering the original list does not change the resource addresses, so buckets are not replaced. This provides the stable addressing required.

terraform state mv renames the address of a resource within state, preserving the association with the real object. Moving the bucket from the root address to the module address means Terraform will plan no changes after the move, because the object is already tracked under the new address. This avoids any destroy or recreate.

Declaring inputs in variables.tf exposes them as named parameters, letting each consuming root module supply values through its own module block or tfvars. This satisfies the requirement that callers provide values without hardcoding them inside the module.

Environment variables are injected into the run's shell environment as key-value pairs, so they reach providers and tooling that read credentials or settings from the operating system rather than from Terraform's input variable mechanism. HCP Terraform supports them at workspace and variable-set scope.

Setting count = var.enabled ? 1 : 0 is the common pattern for optional resource creation.

Terraform's CLI configuration file supports a provider_installation block where you can declare network_mirror or filesystem_mirror sources. When direct registry access is blocked but an internal mirror is reachable, this block redirects provider downloads to the mirror, allowing init to install the AWS provider without public internet access.

A for expression iterating over a collection and wrapping the result in square brackets produces a new list, optionally filtered by an if clause. This matches the stem's requirement, whereas the curly-brace form yields a map instead.

Provider configurations are not resources and cannot be imported, referenced across directories, or shared between root modules. Each root module declares the providers it needs, so the new configuration must define its own aws provider block, even if it mirrors the settings of the existing one.

Variable Sets apply values across every workspace in an organisation, satisfying the requirement for organisation-wide variables. They are scoped at the organisation level rather than per-workspace, unlike workspace variables or Terraform input variables defined in configuration.

Output blocks expose module results to the caller as read-only values. The caller references them via module.<name>.<output>, and cannot assign to them. This cleanly publishes the computed subnet IDs while keeping them immutable from the caller's perspective.

Conditional expressions in Terraform require both the true and false results to be of the same type. If they are not, Terraform will produce an error during plan, indicating that the types do not match. This ensures that the resulting value has a consistent type regardless of the condition.

When execution mode is Remote, HCP Terraform runs plan and apply remotely. If a remote run is active, it holds the state lock. A local apply attempted against the same workspace will fail because the state is locked. The engineer must wait for the remote run to complete or cancel it before applying locally, though best practice is to avoid local applies in remote-mode workspaces.

Splitting inputs, outputs, and resource declarations into variables.tf, outputs.tf, and main.tf is the documented convention, giving consumers a predictable interface. This satisfies the standard structure expected when a directory is consumed as a reusable module.

The zh: entries are platform-specific package hashes, and the colleague's platform is missing from the lock file, so Terraform cannot verify the downloaded package. terraform providers lock with the additional -platform flag records hashes for that platform, and committing the file lets both engineers verify the same provider version reproducibly. This preserves pinning while extending platform coverage.

`flatten()` collapses nested lists into a single flat list, which satisfies the stem's requirement for a valid data transformation function. Terraform's built-in collection functions, including `flatten()`, restructure values during evaluation, so nested structures from variables or outputs become directly usable in resource arguments.

Storing long-lived access keys in ~/.aws/credentials lets the AWS CLI and SDKs resolve credentials automatically via the default profile chain, satisfying the requirement for a file-based configuration method without embedding secrets in code or environment variables.

Switching from count to for_each changes the resource instance keys from numeric indices to string keys. Terraform sees these as different resources and plans to destroy the old and create new ones. Using `terraform state mv` to remap each existing user to the new address preserves the resources and avoids recreation. This is the standard refactoring procedure.

Using `terraform state mv` rewrites the resource's address in the state file from its root-level path to the new child-module path, so Terraform maps the existing remote object to the relocated configuration block. This satisfies the stem's constraint of preventing destroy-and-recreate, since no infrastructure changes are applied.

A registry provides published, versioned modules that teams can pin and reuse, unlike a local file path which offers no versioning or central distribution. This satisfies the cross-organisation sharing and version-control requirement in the stem.

This uses a nested for expression to create a list of lists, then flatten combines them into a single list. Each inner list contains one object per port for that service, and the outer flatten merges all services into a single list. This correctly produces one object per name-port combination.

Removing a resource from state halts tracking without destroying the real infrastructure, satisfying the requirement that the resource be forgotten rather than deleted. Terraform no longer manages or plans changes for it, though the underlying cloud object persists untouched until re-imported or removed manually.

Setting `nullable = false` ensures that if a caller passes `null` for `engine_version`, Terraform uses the default value rather than overriding it with null. This prevents the AWS provider from receiving a null argument, which would cause a validation error. The default remains available for callers who omit the variable entirely, satisfying both requirements.

Using for_each with a map creates one resource instance per map key, and the key becomes part of the resource address. This provides stable identity: adding or removing a key only affects that instance, and existing buckets remain untouched. It is the recommended way to manage multiple similar resources with unique names.