TF-004 Interact with Terraform modules Practice Question
A developer creates a module that provisions an AWS EC2 instance and an S3 bucket. The module outputs the instance ID and bucket ARN. When using this module, the root configuration references module.my_module.instance_id and module.my_module.bucket_arn. After running terraform apply, they notice that the bucket ARN is empty. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that missing outputs in the root configuration cause empty values, but the real issue is almost always a misconfigured output block in the module itself, such as referencing a wrong attribute name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The output value in the module is defined incorrectly, e.g., referencing a non-existent attribute.
The most likely cause of an empty output value is that the output block in the module references an attribute that does not exist on the resource. For example, if the output is defined as `output "bucket_arn" { value = aws_s3_bucket.my_bucket.arn }` but the resource is actually `aws_s3_bucket.my_bucket` and the correct attribute is `arn`, a typo like `arnn` or `id` would cause Terraform to return an empty string (or an error during plan). Terraform validates attribute references at plan time, but if the attribute is missing or misspelled, the output value will be empty or cause a failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The output is defined in the module but not in the root configuration.
Why it's wrong here
Outputs are inherently defined within the module itself to expose specific values to its calling configuration. The root configuration's role is to *reference* or *consume* these module outputs, not to define them directly. If an output is correctly defined within the module, it becomes available for the root configuration to use. An empty output suggests an issue with the value's definition *inside* the module, not its absence from the root's definition.
- ✗
The S3 bucket creation depends on another resource that hasn't been created yet.
Why it's wrong here
Terraform's dependency graph automatically ensures that resources are created in the correct order before any dependent resources or outputs are evaluated. If an S3 bucket's creation was genuinely blocked by an uncreated dependency, Terraform would either pause and wait for resolution or, more likely, issue a clear error indicating a missing resource or a dependency cycle. It would not silently proceed and return an empty string for an attribute of a resource that doesn't yet exist or is in an unready state.
- ✓
The output value in the module is defined incorrectly, e.g., referencing a non-existent attribute.
Why this is correct
When an output block within a module attempts to reference an attribute that does not exist on the specified resource, or uses an incorrect attribute path, Terraform often evaluates this expression to an empty string or a null value. This results in the module's output appearing empty when consumed by the root configuration, as the requested data simply isn't found at the specified location within the resource object. This is a common cause of unexpected empty outputs.
- ✗
The IAM role used by Terraform does not have permission to read the bucket ARN.
Why it's wrong here
A lack of necessary AWS IAM permissions for Terraform to read specific resource attributes, like an S3 bucket's ARN, would typically manifest as an explicit access denied error message during the `terraform plan` or `apply` operation. Terraform performs API calls to retrieve resource details, and permission failures are reported directly as errors, preventing further execution. An empty output value indicates a problem with the *definition* or *evaluation* of the output expression itself, rather than a fundamental authorization failure to retrieve the resource's properties.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.