terraform-associate-003 Sample Questions & Answers

This is the correct syntax. The validation block (not validate) is used within a variable block. The condition argument must be a boolean expression that is true for the value to be valid. Here, var.instance_count > 0 checks for positivity, and floor(var.instance_count) == var.instance_count is a standard way to check if a number is a whole number (an integer). The error_message is returned if the condition is false.

This is a valid Git source URL. The git:: prefix indicates the source type, and the ?ref= argument is used to pin the module to a specific branch, tag, or commit hash.

This is a valid shorthand for a module from the public Terraform Registry. It follows the / / format.

The .terraform.lock.hcl file records dependency checksums for each provider for each platform (OS and architecture) it has been initialized on. If terraform init was only run on macOS, the lock file will only contain hashes for darwin_amd64 or darwin_arm64. When the CI/CD pipeline runs on Linux (linux_amd64), it won't find a matching hash, forcing it to select a provider version based on the constraints and add the new platform's hash to the lock file. To prevent this, terraform providers lock -platform=linux_amd64 -platform=darwin_amd64 should be run.

The terraform_remote_state data source is the standard way to share information between separate Terraform configurations. It allows one configuration to access the output values of another. By adding this data source and configuring it to point to the colleague's remote state, the new team member can reference the required values (like a VPC ID or subnet ID) without duplicating resource definitions.

In HCP Terraform (and Terraform Cloud), a workspace is a container for everything Terraform needs to manage a collection of infrastructure: the configuration itself (often from a VCS repository), the values for input variables, and most importantly, its own separate state file. This allows teams to manage different environments (dev, staging, prod) or components from the same configuration codebase with isolated state and variables.

Storing state centrally is a primary reason for using a remote backend. It allows all team members to work from the same understanding of the infrastructure's current state.

Remote backends like S3 with DynamoDB support state locking, which is crucial for team collaboration. It ensures only one person can run apply at a time, preventing state corruption.

Most remote backends, including Amazon S3, support server-side encryption. This is a critical security feature, as state files can often contain sensitive information.

The terraform force-unlock command is designed specifically for this scenario, where a lock is held by a defunct process and cannot be released automatically. It manually removes the specified lock ID, allowing other operations to proceed. Before running it, one should always verify that no other operation is genuinely in progress to avoid state corruption.

The lifecycle block's precondition checks a condition before a resource is created, updated, or destroyed. This is the ideal place to enforce policies about the configuration of a resource itself. The team can add a precondition that checks if the public endpoint variable is false. If a user tries to set it to true, the terraform plan or apply will fail with the custom error message provided in the precondition, thus enforcing the compliance rule.

This is the correct and safest procedure. When you move HCL code for a resource into a module, its address in the Terraform state changes (e.g., from aws_s3_bucket.my_bucket to module.my_module.aws_s3_bucket.my_bucket). If you just run apply, Terraform will think you want to destroy the old resource and create a new one. The terraform state mv command allows you to update the state file to reflect the new address, telling Terraform that the existing resource is now managed by the code in the new location. A successful refactor will result in a terraform plan that shows no infrastructure changes.

The count meta-argument is used to create a specific number of instances of a resource. It is ideal when the resources are nearly identical and can be differentiated by an index number (count.index). You can set count = length(var.my_list) to create one resource for each item in the list. While for_each also creates multiple resources, it is used when you need to iterate over a map or a set of strings and use unique keys for each resource instance.