HashiCorp Certified: Terraform Authoring and Operations Professional (AWS provider) (AWS provider) (AWS provider) — Questions 76–150

Modifying the state file manually requires careful coordination to avoid conflicts with other team members' operations.

Hard-mandatory policies require the policy to pass before the run can proceed; they cannot be overridden.

Dynamic blocks are specifically intended to generate nested, repeatable blocks within a resource, such as 'ingress' rules in a security group or 'tags' in an instance.

Local provider mirrors can be configured by placing the binary in specific directory structures and using a CLI configuration file.

Using alias in the provider block allows you to define multiple configurations for the same provider.

for_each uses keys which provides stable identities, whereas count uses indices which can cause resource drift if lists change.

The run details page in the HCP Terraform UI displays the cost estimation summary, which can be expanded for details.

Documentation should cover how to use the module, its inputs, and its outputs.

HCP Terraform variables marked as 'sensitive' are stored securely and never displayed in the UI.

It handles the communication between Terraform and the provider binary, and it provides helper functions to define resources.

count is the simplest meta-argument for simple, index-based resource replication where individual resource identity is not critical.

A dynamic block requires a 'for_each' argument to define the iteration, and a 'content' block to define the nested structure.

The create_before_destroy meta-argument ensures that the new resource is created before the old one is destroyed, preventing downtime during replacement.

Advisory policies provide information or warnings in the run logs but do not block the execution.

The schema defines the data structure, types, and constraints for resources and data sources.

Organization structure in HCP Terraform supports centralized management of projects and workspaces across various cloud accounts.

The 'each.value' object is the standard way to access the value in the collection currently being processed by for_each.

The ignore_changes meta-argument allows you to specify a list of attributes that Terraform should skip during the refresh and plan phases.

The count meta-argument creates multiple instances based on an integer, while for_each is designed for sets or maps, making it the idiomatic choice for collections like lists of port numbers.

each.key provides the key of the map entry currently being processed during a for_each iteration.

HCP Terraform serializes runs; the second run will be queued until the first completes.

Agents are used for private network connectivity, compliance requirements, and accessing resources that don't allow public internet access.

Terraform will stop and prompt the user for the missing value during the plan or apply phase if it is not provided via command line or tfvars.

Shared modules and variable sets ensure that configurations and inputs remain consistent across teams and workspaces.

The 'Settings' permission allows users to modify workspace configurations, including variable sets and notification settings.

The 'tfrun' import provides access to metadata about the current run, including the workspace, the user, and the organization.

HCP Terraform uses the current plan to calculate cost impact against the existing state.

The process involves plan generation, policy evaluation, and then awaiting approval before applying.

RBAC in HCP Terraform is granular. You must ensure users do not have the 'Admin' or 'Delete' permissions on the specific workspace.

Providers are either inherited from the root or passed explicitly using the 'providers' map in the module block.

You must either remove the meta-argument from the code or use the state management to remove the resource constraint before re-applying.

HCP Terraform provides centralized state management, locking, and a history of runs, which are critical for teams.

Variable Sets avoid duplication by allowing you to define a set of variables once and reuse them across multiple workspaces.

Agents allow Terraform to run in a private network, accessing resources that are not reachable from the public internet.

The Private Module Registry allows organizations to share verified, reusable infrastructure code internally.

If the referenced resource is deleted, the expression for replace_triggered_by becomes invalid, and Terraform will return an error during the plan phase.

Lifecycle meta-arguments must be placed inside a 'lifecycle' block within the resource block.

The 'read' permission allows viewing runs and state without modification capabilities.

The 'States' tab within a specific workspace shows the full history of state versions.

Permissions control access to workspaces, projects, and the registry.

The replace_triggered_by meta-argument is specifically designed to force replacement when other resources or data sources change.

This command reconciles the state file with the actual infrastructure in the real world to detect drift.

.terraform.lock.hcl is the dependency lock file.

Version constraints can be specified in the required_providers block and through CLI variables (though the latter is less common).

The 'terraform console' command is the standard way to interactively evaluate HCL expressions and debug complex transformations.

Drift causes mismatches, unexpected results, and potential failure during destructive actions.

The UI shows the plan output, the policy check status, and the user who initiated the run.

terraform providers, terraform init, and TF_LOG are the standard ways to troubleshoot provider issues.

Auto-apply in workspace settings allows runs to proceed to completion without manual intervention.

It defaults to the instance of that provider without an alias.

Concatenate the variable inside the resource block using string interpolation.

Using a list directly with for_each is often unstable if the list order changes. Converting it to a set with toset() ensures each item has a stable key.

They are per-resource, support specific arguments, and are defined inside the resource body.

These are common scenarios for ignoring drifts or auto-populated fields in Terraform.

The flatten() function is specifically designed to take nested lists and turn them into a single-level list.

The prevent_destroy lifecycle meta-argument is a safety measure that causes a plan to fail if a resource is marked for deletion.

The replace_triggered_by meta-argument allows forcing a resource to be replaced when another specified resource or attribute changes.

You must provide an alias for every provider instance except for the default one.

Using the 'version' argument in the source block allows pinning to specific tags or branches, ensuring stability.

Defining the 'type' constraint in the variable block ensures Terraform validates the input before applying changes.

If the resource has a unique name or specific constraints (like an S3 bucket name), creating a new instance before destroying the old one will cause a naming collision.

The coalesce() function is ideal for providing a fallback value if the primary input is null.

Terraform downloads providers into the .terraform/providers directory within your project working directory.

The lookup() function allows you to provide a default value to return if the requested key is not found in the map.

The 'read' and 'write' permissions are distinct. Specifically, the 'Plan' permission allows triggering runs, while 'Manage' permissions are required for variables.

Sentinel policies can access the cost estimation data via the 'tfrun' import, but if the estimation is still in progress or failed to generate, the policy will fail.

Using explicit output blocks in the child module makes the data available for access via 'module.<module_name>.<output_name>'.

Terraform requires that both branches of a conditional expression return the same type, otherwise it will throw a type mismatch error during the planning phase.

CLI-driven runs or API overrides can pass different variables to a specific run execution.

Soft-mandatory policies allow a user with the appropriate permissions to override the failure and continue the run.

Terraform Cloud or Terraform Enterprise private module registries are the standard for internal organization-wide sharing.

The 'dynamodb_table' parameter is used with the S3 backend to enable state locking, preventing concurrent operations.

Each intermediate module must define a variable and then pass it down using the 'source' or 'module' call block.

In OPA/Sentinel, you access the plan data structure which contains the resource changes and their associated attributes.

count depends on list order, so removing an item from the middle of the list causes all subsequent resources to be recreated. for_each uses keys, which are stable.