TF-004 Read, generate and modify configuration Practice Question
An operator wants to pass output values from one Terraform configuration to another as input variables. Which approach is recommended?
⚠ Common exam trap
Watch out — candidates often choose Option B (shared file with `file()`) because it seems simple and familiar, but they overlook that Terraform's `file()` function reads a static file at plan time and does not integrate with state management, leading to stale or inconsistent values across runs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a remote state data source to read the outputs from the first configuration's state.
Terraform's remote state data source (e.g., `terraform_remote_state`) allows one configuration to securely read output values from another configuration's state file stored in a shared backend (like S3, Azure Storage, or Consul). This avoids duplication, manual errors, and ensures that the second configuration always uses the latest outputs from the first, without requiring direct file access or environment variables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the output values in a variables file for the second configuration.
Why it's wrong here
Hardcoding output values into a `variables.tf` file in the second configuration is highly impractical and defeats Terraform's automation principles. This method requires manual updates every time the first configuration's outputs change, introducing human error and breaking dynamic infrastructure provisioning. It bypasses Terraform's state management, preventing automatic dependency tracking and consistency checks between configurations.
- ✗
Store outputs in a shared file and use 'file()' function to read them.
Why it's wrong here
Storing outputs in a shared file and using the `file()` function to read them is an anti-pattern for managing inter-configuration dependencies. This approach lacks critical features like state locking, which prevents concurrent modifications and ensures consistency across operations. Furthermore, it does not establish an explicit dependency graph, making it difficult for Terraform to understand the order of operations or detect changes reliably.
- ✓
Use a remote state data source to read the outputs from the first configuration's state.
Why this is correct
Using a `terraform_remote_state` data source is the standard and recommended method for consuming outputs from a separate Terraform configuration. This data source securely reads the specified remote state file, allowing the second configuration to access the first's outputs directly and consistently. It establishes an implicit dependency, ensuring that the source configuration's state is available and up-to-date before the consuming configuration applies changes.
- ✗
Use environment variables to pass the output values.
Why it's wrong here
While environment variables (e.g., `TF_VAR_`) are commonly used to pass *input* variables to a Terraform configuration, they are not designed for consuming *output* values from another configuration. This approach lacks type safety and the ability to handle complex data structures effectively, requiring manual parsing and conversion. More critically, it does not create an explicit dependency between configurations, making state management and change detection unreliable.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.