TF-004 Implement and maintain state Practice Question
You are a DevOps engineer for a company that uses Terraform to manage infrastructure across multiple AWS accounts (production, staging, development). Each account has its own Terraform configuration and remote state stored in an S3 bucket with DynamoDB locking. Recently, the production deployment pipeline failed with the error: 'Error: Error loading state: AccessDenied: Access Denied'. The pipeline runs under an IAM role that has been working for months. The S3 bucket policy and IAM role permissions have not been changed. However, the team did recently enable S3 bucket versioning and added a lifecycle policy to transition objects to Glacier after 30 days. The state file was last modified 35 days ago. What is the most likely cause of the error?
⚠ Common exam trap
HashiCorp often tests the distinction between 'AccessDenied' errors caused by storage class transitions (e.g., Glacier) versus permission-based denials, and the trap here is that candidates may assume the error is due to a policy change or stale lock, ignoring the lifecycle policy's effect on object accessibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
D is correct because the S3 lifecycle policy transitions objects to the Glacier storage class after 30 days. The state file was last modified 35 days ago, so it has been moved to Glacier. Terraform cannot read objects in the Glacier storage class directly; it requires a restoration (e.g., using `aws s3api restore-object`) before the state can be accessed, resulting in the 'AccessDenied' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.
Why it's wrong here
A stale lock in a DynamoDB table, used for Terraform state locking, primarily prevents concurrent write operations to the state file, ensuring consistency. It does not typically block read access to the state file itself from S3. Consequently, a stale lock would manifest as a locking error or a timeout when Terraform attempts to acquire the lock, rather than an AccessDenied error when trying to load the state file.
- ✗
The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.
Why it's wrong here
The problem statement explicitly states that "permissions have not been changed," which directly contradicts the premise of this option. If the IAM role's permissions were indeed revoked, Terraform would certainly encounter an AccessDenied error when attempting to interact with the S3 bucket to retrieve the state file. However, given the constraint provided, this cannot be the underlying cause of the issue.
- ✗
The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.
Why it's wrong here
While an S3 bucket policy can indeed be configured to deny access based on object age or other conditions, the problem statement provides no indication of such a policy change. Furthermore, an S3 lifecycle policy, which manages object transitions between storage classes or object expiration, does not directly modify access permissions or generate an AccessDenied error for a standard GetObject request. Instead, it moves objects, which might lead to an AccessDenied if moved to Glacier without restoration, but not due to a 'denies access' condition key on age.
- ✓
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
Why this is correct
When an S3 object, such as a Terraform state file, is transitioned to the Amazon S3 Glacier or Glacier Deep Archive storage class by a lifecycle policy, it is no longer immediately accessible via standard S3 GetObject requests. Attempting to retrieve an object in Glacier without first initiating a restoration job will result in an AccessDenied error from S3. Terraform requires immediate, direct read access to its state file, making restoration a necessary prerequisite for any operations if the state is archived in Glacier.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.