Terraform Hands-On Interview Questions for Cloud DevOps Engineers

Terraform describes the desired infrastructure state. It builds a dependency graph and decides the create/update/delete sequence.

State maps Terraform resources to real infrastructure objects, allowing Terraform to know what exists and what must change.

Remote state supports collaboration, locking, security and controlled access. Local laptop state is unsafe for teams.

Locking prevents multiple engineers or pipelines from modifying the same state at the same time.

Modules package reusable infrastructure patterns such as VPC, EKS, AKS, RDS or IAM baselines.

Drift happens when real infrastructure changes outside Terraform. Terraform plan detects differences and may revert or update resources.

Write matching configuration, run terraform import or import blocks, check state, run plan and ensure Terraform does not recreate/destroy it.

Use plan reviews, approvals, lifecycle prevent_destroy, policy checks, restricted destroy permissions and state protection.

Pin provider constraints, review changelogs, test upgrades in lower environments and commit lock files where appropriate.

Avoid hardcoding secrets. Use secret managers, environment variables, CI secrets and protect state because sensitive values may appear there.

A resource creates/manages infrastructure. A data source reads existing information without managing lifecycle.

Workspaces create separate state instances, useful in some scenarios but not a complete environment strategy by themselves.

Run fmt, validate, security scan, plan, manual approval and controlled apply with remote state and locked credentials.

Stop, inspect plan details, recent code changes, provider behavior, state address changes and use moved blocks/state mv if refactoring.

Mention state, backend, locking, modules, drift, import, security, CI/CD governance and disaster recovery.