HashiCorp Terraform Associate TF-004 (TF-004) — Questions 301–375

When `terraform apply` is executed, Terraform expects to find configuration files (ending with `.tf`) in the current working directory. These files define the infrastructure resources, providers, and variables that Terraform needs to manage. Without any `.tf` files, Terraform has no configuration to parse or plan against, leading to an error indicating that no configuration was found or that the directory is empty of Terraform files, preventing any operation.

The `.tf` file extension is the universally recognized and standard convention for Terraform configuration files. These files contain infrastructure definitions written in HashiCorp Configuration Language (HCL), specifying resources, data sources, variables, outputs, and providers. Terraform automatically loads and processes all `.tf` files found within a given directory as a single, cohesive configuration, making this extension essential for project organization and execution.

This is the correct pattern: module outputs are consumed as module input variables.

The `terraform apply` command reporting "No changes. Your infrastructure matches the configuration." indicates that all resources defined in the Terraform configuration files are already present in the Terraform state file, and their current attributes align perfectly with the desired state. This means the `random_pet` resource was successfully created during a previous `terraform apply` operation and its existence and configuration are accurately tracked within the state, requiring no further action.

After running `terraform plan -out=tfplan`, executing `terraform show tfplan` is the definitive method to inspect the proposed changes in detail. This command renders the plan file in a human-readable format, explicitly listing each resource modification, including creations, updates, and destructions. Crucially, for destructive changes, it often indicates the specific attribute modifications that necessitate resource replacement or deletion, providing the "why" behind the planned action.

Comply with the policy.

Terraform state can be stored locally in a `terraform.tfstate` file, which is suitable for individual development and testing. For collaborative environments and production deployments, remote state storage is highly recommended. Terraform backends, such as Amazon S3, Azure Storage, or HashiCorp Consul, enable durable, shared, and versioned state management, often including state locking to prevent concurrent modifications and ensure consistency across teams.

The path starts with './' indicating a relative path from the current directory.

The `terraform import` command is the correct and intended workflow for bringing existing infrastructure under Terraform's management. It reads the current state and attributes of a specified remote resource and then records this information within the Terraform state file, associating it with a corresponding resource block in the local configuration. This crucial step allows Terraform to recognize and manage the resource's lifecycle, enabling subsequent `plan` and `apply` operations to detect drift and make controlled modifications without recreating the resource.

The `terraform import` command is the correct and intended mechanism for bringing existing infrastructure resources, which were not originally provisioned by Terraform, under Terraform's management. It reads the current state of a specified resource from the cloud provider and adds a corresponding entry to the Terraform state file, linking it to a defined resource block in the configuration. This process ensures that Terraform can subsequently manage, update, or destroy the imported resource.

Serializing pipeline runs is the most effective and recommended approach to prevent state corruption when using a shared Terraform state backend. This strategy ensures that only one Terraform operation (e.g., plan or apply) can acquire the state lock and modify the state at any given time. By eliminating concurrent execution, it directly addresses the root cause of state locking conflicts and race conditions, maintaining the integrity of the remote state file.

The "terraform import" command is the designated tool for incorporating existing infrastructure resources into Terraform's state management. This process requires specifying the Terraform resource address and the unique identifier of the existing cloud resource, effectively linking them within the state file. Once imported, Terraform can then manage the lifecycle of that previously unmanaged resource, allowing subsequent "terraform plan" and "apply" operations to detect and propose changes to it based on the corresponding HCL configuration.

The `terraform show` command is the definitive tool for inspecting the current state of resources managed by Terraform. It reads the `terraform.tfstate` file and presents a detailed, human-readable representation of all tracked resources, including their attributes and their current values. This command is invaluable for auditing, debugging, and understanding the exact configuration of your deployed infrastructure as recorded in the state file.

Creating a Git repository with a main branch provides version control and a single source of truth for infrastructure code. Using `terraform import` allows existing resources to be brought under management non-disruptively, while remote state in S3 with DynamoDB locking ensures collaborative safety and prevents concurrent state modifications. A CI pipeline with `terraform plan` on PRs and approval enforces code review and validates changes before deployment, establishing robust operational practices.

Migrating the state backend to Terraform Cloud and utilizing remote operations offloads the execution of `terraform apply` from the local machine to HashiCorp's managed infrastructure. This approach effectively bypasses local network instability, proxy configurations, or firewall restrictions that might be causing timeouts when accessing the state backend or provider APIs from the local environment. Terraform Cloud's robust and highly available execution environment ensures reliable communication with the state backend and target cloud providers.

The create_before_destroy lifecycle rule explicitly instructs Terraform to provision the new version of a resource entirely *before* initiating the destruction of the old version when a replacement is necessary. This critical behavior is designed to minimize or eliminate downtime for services by ensuring the updated resource is fully operational and ready to serve traffic before its predecessor is taken offline. It directly addresses the need to maintain continuous availability during resource updates that require recreation, such as an EC2 instance replacement.

This statement is correct. The tilde (`~`) prefix in a `terraform plan` output explicitly indicates that an existing resource will be updated in-place, meaning its attributes will be modified without destroying and recreating the resource itself. For an AWS EC2 instance, changing the `instance_type` from its current value to `t2.small` is a supported in-place modification by the AWS provider, which will apply the change to the running instance.

This option is correct because the `-reconfigure` flag instructs Terraform to disregard any existing backend configuration and reinitialize the backend from scratch. When a backend has been changed to an empty S3 bucket, using `-reconfigure` prevents Terraform from attempting an unnecessary state migration from a non-existent or empty previous state, effectively resetting the backend configuration to the new, empty S3 bucket without errors. This is the most efficient and intended method for such a scenario.

The ~> 4.0 version constraint, known as the pessimistic constraint, precisely specifies that any version greater than or equal to 4.0.0 is acceptable, provided it remains strictly less than 5.0.0. This means it permits minor version increments (e.g., 4.1.0, 4.2.5) and patch updates (e.g., 4.0.1, 4.0.99) within the 4.x series. The primary purpose is to allow for non-breaking updates while preventing automatic upgrades to a new major version that might introduce breaking changes.

Infrastructure as Code (IaC) tools like Terraform automate the entire infrastructure lifecycle, from initial provisioning to updates and deprovisioning. This automation significantly reduces the time required to deploy complex environments compared to manual, click-intensive processes, enabling rapid iteration and scaling of resources.

The output of `terraform state list` explicitly displays the addresses of all resource instances that Terraform is currently managing within its state file for the active workspace. In the exhibit, three distinct resource addresses are clearly enumerated (e.g., `aws_instance.web`, `aws_s3_bucket.mybucket`, `null_resource.example`). This command's primary purpose is to provide an inventory of the resources recorded in the state, directly confirming that the state file is tracking exactly three resources.

Terraform commands, including `terraform plan`, operate strictly within the current working directory where the command is executed, unless explicitly specified otherwise with the `-chdir` option. If configuration files were modified in a separate directory, `terraform plan` run in the original directory would not detect those changes, as it only evaluates the `.tf` files present in its execution context, comparing them against the associated state file.

"The configured state file path's directory does not exist." This is the correct explanation. Terraform requires the parent directory for its state file (e.g., `terraform.tfstate` by default, or a custom path specified in a `local` backend block) to exist on the file system *before* it can write or update the state file. If the directory specified in the backend configuration, or the default `.terraform` directory where state files are typically stored, is missing, Terraform cannot proceed, resulting in an error indicating the directory does not exist.

Implementing run tasks in Terraform Cloud that require approval for any destroy operation on workspaces tagged as 'production' is an effective and scalable solution. Terraform Cloud run tasks allow for custom policy enforcement and integration with external systems, enabling a mandatory manual approval step specifically for destructive actions on critical resources. This provides a robust governance mechanism, ensuring that production infrastructure changes are reviewed and authorized before execution, thereby preventing accidental destruction.

The `variable` block is specifically designed to declare input variables for a Terraform module. Within this block, the `default` argument allows you to specify a fallback value that will be used if no explicit value is provided for the variable through other means, such as command-line arguments, environment variables, or `.tfvars` files. This mechanism ensures that the configuration can proceed even without user input for optional parameters.

The `terraform state show` command is specifically designed to display the current attributes of a particular resource instance as recorded in the Terraform state file. By specifying `aws_instance.example` and including the `-json` flag, the command outputs all attributes of that exact resource in a structured, machine-readable JSON format. This precise and standardized output is ideal for scripting, automation, or direct consumption by other tools needing current state attributes.

Terraform operates on a declarative model, where the configuration file explicitly defines the desired state of infrastructure. When `terraform apply` is executed, Terraform compares this desired state with the current state and provisions resources to match the configuration. Therefore, if `t2.micro` was specified in the configuration, Terraform's primary function is to ensure the created instance adheres precisely to that explicit instruction, making the configuration the authoritative source.

This command correctly follows the `terraform import <ADDRESS> <ID>` syntax, which is essential for bringing existing infrastructure under Terraform management. `aws_s3_bucket.my_bucket` accurately specifies the desired Terraform resource address, indicating it should be managed as an `aws_s3_bucket` resource named `my_bucket` within the configuration. `my-bucket` correctly identifies the exact ID of the pre-existing AWS S3 bucket to be imported into Terraform's state.

terraform plan is a fundamental command in the core Terraform workflow, serving as the crucial second step after initialization. This command generates an execution plan, detailing exactly what actions Terraform will perform to achieve the desired state defined in the configuration files. It allows users to review proposed changes—such as creating, updating, or destroying resources—before any actual modifications are made to the real infrastructure, ensuring predictability and preventing unintended consequences.

Implementing a CI/CD pipeline ensures that all infrastructure changes are applied through an automated, version-controlled process, eliminating local applies and unreviewed modifications that commonly cause drift. This pipeline can run `terraform plan` for review and `terraform apply` automatically upon merge to the main branch, enforcing a single source of truth. Furthermore, integrating Terraform Cloud's Sentinel policies provides policy-as-code enforcement, actively preventing deployments that would introduce drift or violate organizational compliance rules by blocking non-compliant plans before application.

Terraform, as an Infrastructure as Code (IaC) tool, automates the entire infrastructure lifecycle, from initial provisioning to subsequent updates and deletion. By defining infrastructure in declarative configuration files, repetitive manual tasks are eliminated, significantly reducing the time required to deploy complex environments. This automation ensures consistency and dramatically accelerates the delivery of infrastructure resources compared to traditional manual processes, making provisioning much faster.

Terraform init is the command responsible for downloading modules from their specified sources, including the public Terraform Registry. If the internet connection is down or unstable, Terraform cannot establish a connection to the registry to fetch the module's source code. This network connectivity issue directly prevents the initialization process from completing successfully, resulting in an error indicating a failure to download the module.

When an EC2 instance managed by Terraform is manually terminated, Terraform detects this as drift during the `plan` phase. The `aws_instance` resource will be marked for recreation. Since the `aws_eip_association` resource explicitly depends on the `id` of the EC2 instance, Terraform will also identify that the existing Elastic IP needs to be reassociated with the *new* instance. Consequently, Terraform will first provision a new EC2 instance and then update the `aws_eip_association` to link the existing Elastic IP to this newly created instance, restoring the desired state.

Correct! Provider plugins are stored in `.terraform/providers/`.

When a Terraform state is locked, any subsequent `terraform plan` command will fail with an explicit error message indicating that the state is currently locked. This mechanism, facilitated by DynamoDB for S3 backends, prevents concurrent operations that could lead to inconsistent infrastructure or state file corruption. The plan cannot proceed because it requires a stable, consistent view of the state, which the lock protects.

Executing `terraform plan -detailed-exitcode` is the correct approach because it generates an execution plan and signals the outcome through a specific exit code, ideal for CI/CD automation. An exit code of `2` explicitly indicates that a non-empty plan was generated, meaning there are proposed infrastructure changes. Failing the pipeline on this exit code ensures that any intended or unintended modifications are halted for review before an `apply` operation can proceed.

Enabling 'apply on merge' configures the workspace to automatically initiate a Terraform run (plan) whenever code is merged into the configured VCS branch. By additionally setting the workspace to require explicit approval before applying, Terraform Cloud ensures that the planned changes are reviewed and approved by an authorized user within the TFC UI before they are actually provisioned. This combination provides a robust, automated, yet controlled deployment pipeline, aligning VCS changes with a mandatory human gate.

Upon a successful `terraform apply`, all resources defined in the configuration and successfully provisioned by Terraform are recorded in the Terraform state file. Since both `aws_instance.web` and `aws_eip.web` are distinct resources specified in the configuration and are successfully created, both will have corresponding entries in the state file, reflecting their current attributes and IDs in the cloud provider.

This approach is ideal for provisioning multiple module instances, especially when using `for_each` on the module block. By defining a map variable, each key (e.g., "dev", "prod") can represent a distinct environment, and its corresponding value (the CIDR) can be passed directly to that specific module instance. This method ensures clear association, promotes reusability, and allows for dynamic scaling and configuration of environments without modifying the module's source code. It aligns perfectly with Terraform's declarative nature for managing distinct, yet similar, infrastructure components.

If S3 bucket versioning is enabled, every modification or deletion of the Terraform state file creates a new version, preserving previous states. This feature allows an administrator to easily retrieve and restore a previous, known-good version of the state file directly from the S3 bucket's version history. This is the most robust and recommended method for recovering from accidental state file deletion or corruption when using the S3 backend.

When `terraform plan` is executed, it first performs a state refresh, comparing the current configuration against the actual state of resources in the cloud and the Terraform state file. If a previous `apply` was incomplete, this refresh will accurately identify which resources were successfully created or modified. Consequently, the new plan will only propose actions for the remaining resources that are either missing, require further modification, or need to be destroyed according to the desired state defined in the configuration.

Terraform is indeed a powerful infrastructure provisioning tool, enabling users to define and manage cloud and on-premises resources through a declarative configuration language. By describing the desired state of infrastructure in HashiCorp Configuration Language (HCL), Terraform automatically plans and applies the necessary changes to create, update, or destroy resources. This approach ensures consistent, repeatable deployments and efficient lifecycle management across diverse infrastructure providers.

Utilizing distinct state files for each environment, such as development and production, is a critical best practice. This isolation significantly reduces the "blast radius" of potential errors or accidental changes, preventing a misconfiguration in one environment from impacting another. It ensures that infrastructure changes are applied only to their intended target, enhancing stability and operational safety.

The `count` meta-argument in a resource block controls the number of identical resource instances Terraform should manage. When `count` is explicitly set to `0`, Terraform is instructed to manage zero instances of that specific resource. Consequently, if the resource does not currently exist in the state, `terraform plan` will show no changes because it is not intended to be created. If the resource *did* exist, setting `count` to `0` would cause `terraform plan` to propose its destruction.

Using version control systems like Git for Terraform configurations is a fundamental best practice for managing infrastructure as code. It provides a complete, auditable history of all infrastructure code changes, enabling teams to track who made what modifications and when. This facilitates seamless collaboration among multiple developers, allows for easy rollback to previous stable states, and supports robust auditing and compliance requirements by maintaining an immutable record of infrastructure evolution.

The lock will be released when the other engineer's plan completes. Waiting is the safest approach.

Terraform utilizes HashiCorp Configuration Language (HCL) to allow users to express their desired infrastructure state in a human-readable format. This declarative approach means users describe *what* they want, such as a VPC or an EC2 instance, rather than providing imperative step-by-step instructions on *how* to create it. Terraform then intelligently determines the necessary actions to achieve this specified configuration, making infrastructure definition intuitive, versionable, and auditable.

This statement is correct and reflects a fundamental best practice in Terraform. Provisioners introduce imperative steps into a declarative infrastructure-as-code workflow, making configurations less idempotent and harder to manage. Terraform's strength lies in its ability to manage resources declaratively through providers, so provisioners should only be employed when no native resource, data source, or external configuration management tool can achieve the desired outcome.

Defining multiple providers within a single Terraform configuration allows for a truly unified infrastructure as code workflow. This approach enables the declaration and management of resources from different cloud providers (e.g., AWS and Azure) within the same set of `.tf` files, facilitating the creation of cross-provider dependencies and ensuring that `terraform plan` and `apply` operations consider the entire infrastructure holistically.

This syntax correctly accesses an element within a map output named "sg" from a module. Terraform maps are key-value collections, and individual values are retrieved by enclosing their string key, such as "web-sg", in square brackets. This method is the standard and explicit way to reference a specific item when the key is known, ensuring the correct security group ID is retrieved.

Terraform Cloud Run Tasks enable seamless integration with third-party security scanning tools by allowing them to execute as part of the `terraform plan` or `terraform apply` workflow. These tasks can invoke external services to perform static analysis, vulnerability checks, or compliance scans on the planned infrastructure. If the security tool identifies issues, the Run Task can fail the Terraform run, preventing the deployment of non-compliant or insecure resources.

Using a remote backend like Amazon S3 for state storage, combined with DynamoDB for state locking, is a highly recommended and standard practice for collaborative Terraform environments. S3 provides durable, highly available, and versioned storage for the state file, while DynamoDB ensures mutual exclusion, preventing multiple users or processes from concurrently modifying the state and thereby avoiding corruption during `terraform apply` operations.

The primary purpose of this `data "aws_ami"` block is to dynamically query the AWS API and retrieve the unique identifier (ID) of an existing Amazon Machine Image that matches the specified criteria. By filtering for `ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*`, `architecture = "x86_64"`, and `virtualization_type = "hvm"`, and then selecting the latest image, the data source efficiently fetches the most current AMI ID for Ubuntu 20.04, making it available for use in other resource configurations.

When "terraform apply" is executed in a working directory that has not been initialized, Terraform cannot proceed with the requested operation. The "apply" command fundamentally depends on the presence of downloaded provider plugins, a configured state backend, and potentially installed modules, all of which are established during the "terraform init" phase. Consequently, Terraform will halt execution and output a specific error message, clearly indicating that the working directory requires initialization before the "apply" command can be successfully executed.

The "default" workspace is a fundamental component of Terraform's workspace management, automatically created when `terraform init` is first run in a directory. This workspace serves as the initial and fallback environment for state management. It cannot be deleted using `terraform workspace delete default` because Terraform requires at least one active workspace to manage state, ensuring continuity and preventing accidental loss of the primary state file.

Kubernetes is not a supported Terraform backend for state storage.

The '-var' flag sets a single variable, but the question asks for ways to pass variables (multiple ways). This is a valid way, but it's not a file. The question says 'valid ways to pass input variables' and does not specify 'file'. So both A and B are correct? Let's rethink: Option B: '-var-file' is indeed a valid way to pass a file. Option C: '-var' is also valid. But the instruction says exactly 2 correct. I need to ensure only two are correct. I'll adjust: Option B should be something else that is incorrect. Let me correct the options.

When Terraform attempts to acquire a state lock using DynamoDB, it performs a conditional write operation to a specific item in the lock table. A "conditional check fails" error specifically indicates that this write could not proceed because the expected conditions were not met, typically meaning another process has already written a lock item or the version ID does not match. This mechanism prevents concurrent state modifications, signifying that another Terraform process is actively holding the lock to protect state integrity and avoid race conditions.

The tilde symbol (`~`) in a Terraform plan output explicitly indicates that an existing resource attribute will be modified in-place without destroying and recreating the entire resource. When changing an AWS EC2 `instance_type`, the underlying cloud provider typically performs a stop and start operation on the instance to apply the new configuration. This stop/start cycle inherently causes a temporary interruption in service, which often manifests as a system reboot from the operating system's perspective.

The `terraform_remote_state` data source is specifically designed to read outputs from a Terraform state file stored in a remote backend. By configuring this data source with the appropriate backend type and configuration, a separate Terraform configuration can securely access and utilize the output values defined in another, previously applied, Terraform configuration. This enables modularity and dependency management across distinct infrastructure deployments.

The `terraform plan` command is central to desired state enforcement in Terraform. It meticulously compares the infrastructure's current state, as recorded in the state file and potentially observed live, against the desired configuration defined in the Terraform files. The resulting plan details all the actions (creations, updates, destructions) required to reconcile any discrepancies, thereby showing precisely what is needed to achieve the desired infrastructure state.

for_each = module.networks iterates over each module instance, allowing access to its outputs via each.value.

When a Terraform operation fails or is interrupted, it can leave behind a stale state lock in the remote backend, such as an entry in the DynamoDB table. The `terraform force-unlock <lock_id>` command is specifically designed to remove such persistent, but no longer active, lock entries. By providing the unique `lock_id`, this command directly instructs the backend to clear the specific lock, enabling subsequent Terraform operations to proceed safely.

The `depends_on` meta-argument is Terraform's explicit mechanism for defining a direct dependency between resources that cannot be inferred automatically through attribute references. When Terraform's implicit dependency graph, built by referencing resource attributes, is insufficient to ensure a specific creation, update, or destruction order, `depends_on` forces one resource to be fully created or updated before another resource begins its lifecycle operations. This ensures proper sequencing for complex or non-obvious inter-resource relationships.

Terraform modules declare their minimum required Terraform version using the `terraform` block's `required_version` argument. If the current Terraform CLI version is older than this specified requirement, the `terraform init` command will fail with an explicit error, preventing any further operations. Upgrading the Terraform CLI to a version that meets or exceeds the module's `required_version` is the most straightforward and intended solution to resolve this compatibility issue, allowing the configuration to initialize successfully.

Terraform Cloud allows variables to be set at various levels, with a specific order of precedence. A CI/CD pipeline often initiates runs via the Terraform Cloud API, which can include `TF_VAR_` environment variables or `terraform.tfvars` content that overrides variables configured directly in the workspace UI. If the pipeline injects different tag values through these mechanisms, the resulting Terraform plan will differ, causing the Sentinel policy to detect a non-compliant resource configuration.

When the configured DynamoDB table for state locking is unavailable or missing, Terraform cannot acquire the necessary lock before executing state-modifying commands like `terraform apply` or `terraform plan`. This immediately results in a locking error, preventing any operation that could potentially corrupt the remote state file. Terraform prioritizes state integrity by failing explicitly rather than proceeding unsafely.

The `providers` argument within a `module` block is the correct and explicit mechanism for passing specific provider configurations from the calling module to a child module. By using `providers = { aws = aws.uswest }`, the child module's expectation for an `aws` provider is satisfied by the `uswest` aliased `aws` provider configuration defined in the root module. This ensures the module operates with the intended, aliased provider configuration.

This statement accurately describes Terraform's fundamental purpose. As an infrastructure-as-code tool, Terraform enables users to define infrastructure declaratively using HCL, allowing for version-controlled, repeatable, and automated provisioning and management of resources. Its robust provider framework supports a vast array of platforms, including major cloud providers, on-premises virtualization, and SaaS applications, facilitating consistent infrastructure deployment across diverse environments.