Chapter 43: Terraform Interview Questions and Capstone Project

43.3 Capstone part 1 — the brief and the repository layout

By Ravindra Bagale · Last updated: 25 October 2026

Story. Your capstone mirrors what an Instagram-style feature team would ask of a new DevOps engineer in the first month. Build the badge web service on AWS fully in Terraform, with a reusable module, remote state with locking, two environments, and a Jenkins pipeline with scans and approval. Every requirement below must be shown with real output. Then destroy it all.

capstone/
  bootstrap/            # S3 state bucket, versioning, encryption, public access block
  modules/
    network/            # VPC, 2 public subnets, IGW, route table (Chapter 40 part 1)
    web-server/         # SG (HTTP only), EC2 with nginx user_data, IMDSv2, IAM role
  envs/
    dev/   backend.tf main.tf dev.tfvars
    prod/  backend.tf main.tf prod.tfvars
  Jenkinsfile           # validate, Checkov, tfsec, plan, approval, apply (Chapter 41)
  drift-check.sh        # nightly plan -detailed-exitcode (Chapter 42)
  .gitignore            # state, .terraform, personal tfvars
  README.md             # how to run, how to destroy

What each line does

• bootstrap/ — Creates the state bucket once; applied before anything else.
• modules/network/ — The VPC code from Chapter 40 turned into a module.
• modules/web-server/ — The security group, instance and role as one module.
• envs/dev/ and envs/prod/ — Two roots with separate state keys and tfvars.
• Jenkinsfile — The pipeline from Chapter 41.
• drift-check.sh — The nightly drift job from Chapter 42.
• .gitignore — Keeps state and personal values out of Git.
• README.md — Run and destroy instructions for the reviewer.

When it is green.

$ terraform -chdir=envs/dev validate
Success! The configuration is valid.
$ checkov -d . --quiet
Passed checks: 57, Failed checks: 0, Skipped checks: 0

When it is red.

$ git status
    new file:   envs/dev/terraform.tfstate

Fix. State is about to be committed. Fix .gitignore, git rm --cached the file, and confirm the remote backend is configured.

What: every term in plain English

• bootstrap — A tiny Terraform folder that creates the state bucket once, before everything else.
• module — A folder of Terraform code you call many times with different inputs.
• root module — The folder where you run terraform, such as envs/dev.
• backend key — The path of one state file inside the bucket, such as badge-api/dev.tfstate.
• tfvars — A file of input values for one environment.
• prevent_destroy — A lifecycle rule that stops terraform destroy on a resource.
• public access block — An S3 setting that blocks every public access path.

Example 1: Bootstrap the state bucket

Every Swiggy-style platform team starts with the bucket that will hold all other state. It is created once with local state.

# bootstrap/main.tf
provider "aws" {
  region = "ap-south-1"
}

data "aws_caller_identity" "me" {}

resource "aws_s3_bucket" "state" {
  bucket = "badge-tfstate-${data.aws_caller_identity.me.account_id}"
  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_s3_bucket_versioning" "state" {
  bucket = aws_s3_bucket.state.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "state" {
  bucket = aws_s3_bucket.state.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "state" {
  bucket                  = aws_s3_bucket.state.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

output "bucket" {
  value = aws_s3_bucket.state.bucket
}

cd capstone/bootstrap
terraform init
terraform apply -auto-approve
terraform output -raw bucket

Output

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

bucket = "badge-tfstate-111122223333"
badge-tfstate-111122223333

What it shows: Write the bucket name into both backend.tf files. The bootstrap state stays local; keep it safe.

Example 2: The web-server module

The module holds the security group, role and instance so dev and prod use the same tested code.

# modules/web-server/variables.tf
variable "env" {
  type = string
}
variable "instance_type" {
  type    = string
  default = "t3.micro"
}
variable "subnet_id" {
  type = string
}
variable "vpc_id" {
  type = string
}

# modules/web-server/main.tf
data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

resource "aws_security_group" "web" {
  name   = "badge-${var.env}-web"
  vpc_id = var.vpc_id
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami                    = data.aws_ami.al2023.id
  instance_type          = var.instance_type
  subnet_id              = var.subnet_id
  vpc_security_group_ids = [aws_security_group.web.id]
  user_data              = file("${path.module}/nginx.sh")
  metadata_options {
    http_tokens = "required"
  }
  tags = {
    Name = "badge-${var.env}"
  }
}

# modules/web-server/outputs.tf
output "web_url" {
  value = "http://${aws_instance.web.public_ip}"
}

Output

$ terraform -chdir=envs/dev validate
Success! The configuration is valid.

What it shows: Only port 80 is open. You reach the server with SSM Session Manager, not SSH.

Example 3: Two environments from one module

An Airtel-style team wants dev cheap and prod a bit bigger, with separate state so a dev mistake never touches prod.

# envs/dev/backend.tf
terraform {
  backend "s3" {
    bucket       = "badge-tfstate-111122223333"
    key          = "badge-api/dev.tfstate"
    region       = "ap-south-1"
    use_lockfile = true
  }
}

# envs/dev/main.tf
variable "env" {}
variable "instance_type" {}

module "network" {
  source = "../../modules/network"
  env    = var.env
}

module "web" {
  source        = "../../modules/web-server"
  env           = var.env
  instance_type = var.instance_type
  vpc_id        = module.network.vpc_id
  subnet_id     = module.network.public_subnet_ids[0]
}

output "web_url" {
  value = module.web.web_url
}

# envs/dev/dev.tfvars
env           = "dev"
instance_type = "t3.micro"

terraform -chdir=envs/dev init
terraform -chdir=envs/dev plan -var-file=dev.tfvars | tail -1

Output

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Plan: 12 to add, 0 to change, 0 to destroy.

What it shows: prod is the same folder shape with key badge-api/prod.tfstate and instance_type t3.small.

Example 4: Keep secrets and state out of Git

Reviewers fail a capstone at once if state or keys are committed. Set .gitignore first.

# .gitignore
.terraform/
*.tfstate
*.tfstate.*
crash.log
*.tfplan
tfplan
override.tf
*.auto.tfvars

git add .
git status --short

Output

A  .gitignore
A  Jenkinsfile
A  README.md
A  envs/dev/backend.tf
A  envs/dev/dev.tfvars
A  envs/dev/main.tf
A  modules/web-server/main.tf
A  .terraform.lock.hcl

What it shows: dev.tfvars has no secrets, so it can be committed. Passwords come from Secrets Manager, never from tfvars.

Command cheat sheet

Verify: did it work?

1. State in S3

   aws s3 ls s3://badge-tfstate-111122223333/badge-api/
   

   Output

   2026-10-25 10:02:11      18233 dev.tfstate
   

2. Module valid

   terraform -chdir=envs/dev validate
   

   Output

   Success! The configuration is valid.
   

3. No state in Git

   git ls-files | grep -c tfstate
   

   Output

   0
   

When it is red 1

Error: Failed to get existing workspaces: S3 bucket "badge-tfstate-111122223333" does not exist.

Cause. The backend bucket name is wrong or bootstrap was not applied.

Fix, step by step

1. Run terraform output -raw bucket in bootstrap.
2. Copy the exact name into backend.tf.
3. Run init again.

When it is red 2

Error: Unreadable module directory
Unable to evaluate directory symlink: lstat ../../modules/web-server: no such file or directory

Cause. The relative module path is wrong.

Fix, step by step

1. Count the folders up from envs/dev.
2. Use ../../modules/web-server.
3. Run init again.

When it is red 3

Error: Instance cannot be destroyed
Resource aws_s3_bucket.state has lifecycle.prevent_destroy set

Cause. You ran destroy on bootstrap while prevent_destroy is on. This is the guard working.

Fix, step by step

1. Destroy envs first.
2. Remove prevent_destroy only at the very end.

Cleanup

terraform -chdir=envs/dev destroy -var-file=dev.tfvars -auto-approve

Practice tasks

Homework: try at home

Recap

• Bootstrap creates the state bucket once.
• Modules hold tested code; envs hold values.
• Each env has its own state key.
• .gitignore keeps state and plans out of Git.
• Only port 80 is open; use SSM for access.

FAQ

Why not workspaces for dev and prod?

Separate folders make the backend and access clear. Workspaces are fine for short-lived copies.

Why local state for bootstrap?

The bucket does not exist yet. Some teams move it in later with init -migrate-state.

Can I use Terraform Cloud instead?

Yes, but the capstone shows S3 so you learn how backends work.

Where does the network module come from?

Chapter 40 part 1, turned into a module with vpc_id and subnet outputs.

How big should a capstone be?

Small enough to destroy in five minutes. About 12 resources per environment.

Interview questions

1. How do you lay out Terraform for many environments?

   Shared modules plus one root folder per environment, each with its own state key.

2. How do you create the state bucket itself?

   A small bootstrap stack with local state, versioning, encryption and a public access block.

3. Why IMDSv2?

   It needs a token, which blocks many SSRF attacks on instance metadata.

4. What goes in .gitignore?

   State, plan files, .terraform and personal tfvars.

5. Why not open port 22?

   SSM gives shell access with IAM and logs, without an open port.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards