Chapter 70: DevOps Interview Questions by Topic and Company
70.7 Terraform Interview Questions
Terraform madhe state file sarvat mahatvachi. State, locking aani drift he samjla ki nimma interview zala.
What you will learn in this lesson
- 36 real Terraform questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
Infrastructure is now written as code. Interviewers check if you can keep state safe, avoid drift and run Terraform from CI.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: LTIMindtree (10), TCS (7), Deloitte (7), Capgemini (6), Wipro (5), Tech Mahindra (5).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. What is Infrastructure as Code?
Why: Clicking in consoles does not scale.
What: IaC means writing infrastructure in code files kept in Git.
How: Benefits: repeatable, reviewed, versioned. Tools: Terraform, CloudFormation, Pulumi.
Q2. What do terraform init, plan and apply do?
Why: The basic workflow.
What: init downloads providers and sets the backend. plan shows changes. apply makes them.
How: Always read the plan before apply.
terraform init
terraform plan -out tf.plan
terraform apply tf.plan
Q3. What is the Terraform state file?
Why: Terraform needs memory of what it built.
What: terraform.tfstate maps code to real resources and stores attributes.
How: Keep it in a remote backend (S3 + locking), never edit it by hand, never commit it.
Q4. What are Terraform modules?
Why: Reuse instead of copy-paste.
What: A module is a folder of .tf files with inputs and outputs.
How: Call it with a module block and pin versions.
module "vpc" {
source = "./modules/vpc"
cidr = "10.0.0.0/16"
}
Q5. What do terraform validate and terraform fmt do?
Why: Basic quality checks in CI.
What: fmt formats code. validate checks syntax and references.
How: Run both in PR checks.
terraform fmt -check -recursive
terraform validate
Q6. What is the difference between Terraform and Ansible?
Why: They are often confused.
What: Terraform creates infrastructure (declarative, stateful). Ansible configures servers (procedural, agentless, no state).
How: Use Terraform to create EC2, Ansible to install software on it.
Q7. Write Terraform code to create an EC2 instance.
Why: A common live task.
What: A resource block with an AMI and instance type.
How: Add tags and security group.
resource "aws_instance" "web" {
ami = data.aws_ami.al2023.id
instance_type = "t3.micro"
tags = {Name = "web"}
}
Q8. What is a Terraform provider?
Why: Terraform talks to APIs through providers.
What: A provider is a plugin for one platform (AWS, Azure, Kubernetes).
How: Pin versions in required_providers.
terraform {
required_providers {
aws = {source = "hashicorp/aws", version = "~> 5.0"}
}
}
Q9. What are outputs and variables in Terraform?
Why: Inputs and results.
What: Variables are inputs; outputs show values after apply or pass them to other modules.
output "vpc_id" {
value = aws_vpc.main.id
}
Experienced questions (2-5 years)
Q10. How do you secure the Terraform state file?
Why: State can contain secrets.
What: It may store passwords and keys in plain text.
How: Use an S3 backend with encryption, versioning, blocked public access, tight IAM, and state locking.
terraform {
backend "s3" {
bucket = "tf-state-prod"
key = "app/terraform.tfstate"
region = "ap-south-1"
encrypt = true
use_lockfile = true
}
}
Q11. What is state locking and why is it needed?
Why: Two applies at once corrupt state.
What: Locking lets only one run change state at a time.
How: Use S3 native locking (use_lockfile) or DynamoDB, or Terraform Cloud. Run applies only from CI.
terraform force-unlock <LOCK_ID>
Q12. How do you handle sensitive variables in Terraform?
Why: Secrets in code get leaked.
What: Mark variables sensitive = true to hide them in output (they are still in state).
How: Pass them via environment variables (TF_VAR_x) or read from Secrets Manager/Vault data sources.
variable "db_password" {
type = string
sensitive = true
}
Q13. How do you manage multiple environments in Terraform?
Why: Dev and prod must be separate.
What: Options: separate folders per env with their own state, workspaces, or Terragrunt.
How: Separate state per env; same modules, different tfvars.
terraform apply -var-file=prod.tfvars
Q14. What are Terraform workspaces?
Why: One way to handle environments.
What: Workspaces give separate state files for the same code.
How: Good for similar envs; many teams prefer folders for prod isolation.
terraform workspace new dev
terraform workspace select dev
Q15. What is drift and how do you detect it?
Why: Manual console changes break IaC.
What: Drift is when real infrastructure differs from code/state.
How: Run terraform plan regularly (scheduled job); fix by updating code or applying again. Block manual changes with IAM.
terraform plan -detailed-exitcode
Q16. What is the difference between count and for_each?
Why: Wrong choice causes resource recreation.
What: count makes N copies indexed by number. for_each makes copies keyed by map/set values.
How: Use for_each when items may be added or removed, so others are not recreated.
resource "aws_s3_bucket" "b" {
for_each = toset(["logs","assets"])
bucket = "ravi-${each.key}"
}
Q17. What are dynamic blocks?
Why: Repeating nested blocks cleanly.
What: A dynamic block creates repeated nested blocks from a list.
How: Common for security group rules.
dynamic "ingress" {
for_each = var.ports
content {
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = ["10.0.0.0/16"]
}
}
Q18. What are lifecycle blocks?
Why: Control how resources change.
What: lifecycle sets rules: create_before_destroy, prevent_destroy, ignore_changes.
How: Use prevent_destroy on databases to stop accidental deletes.
lifecycle {
prevent_destroy = true
}
Q19. What is the difference between terraform plan, refresh and apply?
Why: Tests understanding of state.
What: plan compares code with real state and shows changes. refresh updates state from real resources (now terraform apply -refresh-only). apply makes changes.
terraform apply -refresh-only
Q20. How do you bring existing resources under Terraform?
Why: Old infrastructure was made by hand.
What: Import adds a real resource into state.
How: Write the resource block, then use terraform import or an import block, and run plan until no changes.
import {
to = aws_s3_bucket.logs
id = "ravi-logs"
}
Q21. How do you manage resources created outside Terraform?
Why: Common in real companies.
What: Either import them, read them with data sources, or leave them out.
How: Decide ownership; import if Terraform should manage it.
data "aws_vpc" "main" {
tags = {Name = "main"}
}
Q22. How do you get VPC details dynamically in Terraform?
Why: Avoid hardcoded IDs.
What: Data sources read existing resources.
How: Look up the VPC and subnets by tags.
data "aws_subnets" "private" {
filter {
name = "vpc-id"
values = [data.aws_vpc.main.id]
}
}
Q23. The state file is corrupted. What do you do?
Why: Recovery skills matter.
What: State is the map; without it Terraform is blind.
How: 1) Stop all runs. 2) Restore the previous version from S3 versioning. 3) Run plan to check. 4) Fix small issues with terraform state rm/import.
aws s3api list-object-versions --bucket tf-state-prod --prefix app/
Q24. How do you prevent concurrent Terraform runs?
Why: Two engineers applying at once is dangerous.
What: Use state locking plus a single way to apply.
How: Remote backend with locking, apply only via CI with concurrency limits, short-lived roles.
Q25. Terraform apply failed halfway. What do you do?
Why: Partial applies are common.
What: Terraform saves what it created; state shows partial results.
How: 1) Read the error. 2) Fix the cause. 3) Run plan again; Terraform continues from where it stopped. 4) Remove tainted resources if needed.
terraform plan
Q26. Apply succeeded but resources do not work as expected. Why?
Why: Correct code is not always correct design.
What: Terraform only checks API success, not app behaviour.
How: Check security groups, routes, IAM policies, health checks and dependencies; add tests (terraform test, Terratest).
Q27. How do you run Terraform in CI/CD?
Why: Applies should be reviewed and repeatable.
What: Pipeline: fmt, validate, scan, plan on PR, apply after approval on merge.
How: Use OIDC roles, save the plan file, and post the plan to the PR.
Q28. How do you make Terraform runs faster?
Why: Slow plans waste time.
What: Speed depends on the number of resources and API calls.
How: Split states, use -target only for emergencies, raise -parallelism, and cache providers.
terraform plan -parallelism=20
Q29. What is the difference between CloudFormation and Terraform?
Why: AWS shops ask this.
What: CloudFormation is AWS-only and state is managed by AWS. Terraform is multi-cloud with its own state.
How: Choose Terraform for multi-cloud or wide provider support; CloudFormation for AWS-native features.
Q30. Write Terraform for a VPC with public and private subnets.
Why: Very common design task.
What: VPC, subnets, IGW, NAT gateway, route tables.
How: Use the community VPC module or write resources; spread subnets across AZs.
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
}
Q31. How do module dependencies work in Terraform?
Why: Order matters.
What: Terraform builds a graph from references; using one module's output in another creates a dependency.
How: Use depends_on only when there is no direct reference.
subnet_ids = module.vpc.private_subnets
Q32. What does terraform taint / -replace do?
Why: Sometimes a resource must be rebuilt.
What: It marks a resource to be destroyed and created again.
How: Use terraform apply -replace=addr today.
terraform apply -replace=aws_instance.web
Q33. What do terraform state list, mv and rm do?
Why: Refactoring code needs state changes.
What: list shows resources. mv renames addresses. rm forgets a resource without deleting it.
How: Use moved blocks for safe refactors.
terraform state mv aws_instance.a aws_instance.web
Q34. What are common Terraform issues you faced?
Why: Real-world experience check.
What: Typical: state lock stuck, drift, provider version changes, cycles, wrong count indexes.
How: Explain one issue and your fix.
Senior questions
Q35. How do you manage a very large Terraform state?
Why: Big states are slow and risky.
What: One giant state means slow plans and a big blast radius.
How: Split by layer (network, data, apps) and by environment; share values with outputs or data sources.
Q36. How do you deploy the same infrastructure to 10 regions?
Why: Scale and consistency.
What: Reuse one module with a region input.
How: Use provider aliases or one state per region with a loop in the pipeline.
provider "aws" {
alias = "mumbai"
region = "ap-south-1"
}
Practice tasks
Easy What do terraform init, plan and apply do?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you secure the Terraform state file?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What is state locking and why is it needed?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What are Terraform modules?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you handle sensitive variables in Terraform?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What do terraform validate and terraform fmt do?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you manage multiple environments in Terraform?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What are Terraform workspaces?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 36 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- What do terraform init, plan and apply do? - init downloads providers and sets the backend.
- What are Terraform modules? - A module is a folder of .tf files with inputs and outputs.
- What is drift and how do you detect it? - Drift is when real infrastructure differs from code/state.
- How do you secure the Terraform state file? - It may store passwords and keys in plain text.
- What is state locking and why is it needed? - Locking lets only one run change state at a time.
Quick quiz
Q1. What is Infrastructure as Code?
IaC means writing infrastructure in code files kept in Git.
Q2. How do you manage multiple environments in Terraform?
Options: separate folders per env with their own state, workspaces, or Terragrunt.
Q3. How do you manage resources created outside Terraform?
Either import them, read them with data sources, or leave them out.
Q4. How do you deploy the same infrastructure to 10 regions?
Reuse one module with a region input.
Q5. What are outputs and variables in Terraform?
Variables are inputs; outputs show values after apply or pass them to other modules.
Samajla ka?
Revision card
Interview card
Comparison card