Terraform Interview Questions & Answers (2026)
These interviews test your ability to design, implement, and manage infrastructure as code with Terraform. Focus on core concepts, state handling, modules, and provider interactions. Demonstrate practical experience, explain trade‑offs, and show how you ensure reproducibility, security, and collaboration to impress interviewers.
22 questions · updated Aug 29, 2026
Quick facts
| Typical rounds | Phone screen, technical deep‑dive, and a hands‑on coding exercise |
| Core topics | State management, modules, workspaces, provisioners, and lifecycle rules |
| Preferred experience | 2‑4 years of IaC with Terraform, plus CI/CD integration |
| Common tools | Terraform CLI, Terraform Cloud/Enterprise, and cloud provider CLIs |
Questions
Beginner
What is Terraform state and why is it important?
Terraform state is a JSON file that records the mapping between your configuration and the real resources. It enables Terraform to detect drift, plan incremental changes, and manage dependencies. A strong candidate mentions remote backends for team safety, state locking to avoid race conditions, and the security implications of storing sensitive data in state files.
How does Terraform handle resource dependencies?
Terraform builds a dependency graph based on explicit references (e.g., using another resource's attribute) and implicit relationships like provisioner ordering. It then applies resources in topological order, ensuring dependent resources are created after their prerequisites. Interviewers look for understanding of the graph, the use of depends_on to break cycles, and the impact on parallelism.
Explain the purpose of Terraform workspaces.
Workspaces allow multiple instances of a configuration to share the same code but maintain separate state files, useful for environments like dev, staging, and prod. A candidate should note that workspaces are not a substitute for proper environment segregation via separate backends, and that variables still need to be managed per workspace.
What is the purpose of the terraform import command?
terraform import brings existing infrastructure under Terraform management by mapping a real resource to a resource block in state. It does not generate configuration; you must write the matching HCL manually. Interviewers expect you to discuss the need for accurate resource IDs and the limitations with complex resources.
Intermediate
What are Terraform modules and why use them?
Modules are reusable, encapsulated blocks of configuration that promote DRY principles and enable consistent patterns across projects. They simplify complex setups, allow versioning, and facilitate collaboration. Interviewers expect you to discuss public vs private registries, input/output variables, and how modules improve maintainability and testing.
How do you manage secrets in Terraform without exposing them in state?
Use external secret stores like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault, and reference them via data sources or the vault provider. Avoid inline sensitive values; mark variables as sensitive to suppress logs. A strong answer also covers using remote backends with encryption at rest and in transit.
Describe the lifecycle meta‑argument and its use cases.
The lifecycle block controls resource creation, update, and deletion behavior. create_before_destroy ensures zero‑downtime during replacements; prevent_destroy protects critical resources; ignore_changes tells Terraform to ignore specific attribute drift. Candidates should explain when each is appropriate, such as using create_before_destroy for load balancers to avoid outages.
What is a remote backend and when should you use one?
A remote backend stores state outside the local machine, enabling team collaboration, state locking, and encryption. Common backends include S3 with DynamoDB locking, Azure Blob Storage, and Terraform Cloud. Use a remote backend for any production or multi‑developer environment to prevent state corruption and to centralize access control.
How do you handle resource drift detection?
Run terraform plan regularly; any differences between state and real resources appear as changes. For automated detection, integrate plan runs in CI pipelines and set alerts on unexpected modifications. A strong candidate mentions using remote state backends with versioning to audit drift over time.
Explain the use of data sources in Terraform.
Data sources read information from existing resources without managing their lifecycle, enabling you to reference attributes of resources created outside Terraform or by other modules. This supports cross‑stack dependencies and dynamic configuration. Interviewers look for examples like data "aws_ami" to fetch the latest AMI ID.
What is the purpose of the -target option and when is it appropriate to use it?
-target limits the plan/apply to specific resources, useful for debugging or incremental rollouts. However, it can bypass dependency checks, leading to inconsistent state. Interviewers expect you to advise using it sparingly, documenting the reason, and running a full plan afterwards to reconcile the full graph.
What is the difference between a local‑exec and remote‑exec provisioner?
local‑exec runs a command on the machine executing Terraform, useful for generating files or invoking external tools. remote‑exec connects to the target resource via SSH or WinRM to run commands on the provisioned instance. Interviewers look for awareness of network requirements, idempotency concerns, and when each is appropriate.
Explain how Terraform handles version control of modules.
Modules are versioned via source references, such as Git tags, branches, or Terraform Registry versions. Pinning a version ensures reproducible builds. Terraform will fetch the specified version during init and will not automatically upgrade unless the constraint is changed. Candidates should discuss semantic versioning and the impact on CI/CD.
Advanced
How does Terraform handle provider versioning and why is it critical?
Provider version constraints in the required_providers block lock the provider to a compatible version, preventing breaking changes from newer releases. Pinning versions ensures reproducible runs across environments. Interviewers expect you to discuss using the terraform init -upgrade flag, provider source addresses, and the impact on CI pipelines.
Explain the difference between terraform plan and terraform apply.
terraform plan generates an execution plan showing proposed changes without modifying infrastructure, allowing review and approval. terraform apply executes that plan, creating, updating, or destroying resources. A good answer mentions using -out to save the plan, then applying with -input=false for automation, and the importance of CI gatekeeping.
What are provisioners and when should you avoid them?
Provisioners run scripts or remote commands after resource creation, useful for bootstrapping when no native resource exists. However, they break idempotency and can cause drift; prefer native resources or cloud‑init. Interviewers look for awareness of their limitations, error handling, and fallback strategies.
How can you test Terraform code before applying to production?
Use terraform validate for syntax, terraform fmt for style, and terraform plan with a mock backend to preview changes. For deeper testing, employ Terratest (Go) or kitchen‑terraform (Ruby) to run integration tests against real clouds, and leverage policy-as-code tools like Sentinel or OPA to enforce compliance.
What are the benefits and drawbacks of using Terraform Cloud versus open‑source Terraform?
Terraform Cloud provides remote state, team collaboration, run queues, policy enforcement, and private module registries, reducing operational overhead. Drawbacks include cost, vendor lock‑in, and less flexibility for custom workflows. A solid answer weighs security, compliance, and scaling needs against budget constraints.
How would you migrate an existing Terraform project to a new remote backend?
First, configure the new backend block, then run terraform init -migrate-state to copy the state safely. Verify that the state file matches the resources, and lock the old backend during migration to avoid race conditions. Mention testing with terraform plan after migration to ensure no unintended changes.
Describe how you would implement blue‑green deployment using Terraform.
Create two identical environments (blue and green) using modules, route traffic via a load balancer or DNS switch, and update the inactive environment with new changes. After validation, shift traffic to the updated environment and decommission the old one. Emphasize immutable infrastructure, minimal downtime, and state separation for each environment.
How can you enforce organizational policies on Terraform configurations?
Use Sentinel (Terraform Cloud/Enterprise) or Open Policy Agent to write policy-as-code that validates plans against security, cost, and compliance rules. Policies can reject non‑compliant resources, enforce tag standards, or limit instance types. Candidates should discuss integrating policies into CI pipelines for early feedback.
What strategies can you use to reduce Terraform plan time in large environments?
Split the configuration into smaller modules or separate workspaces, use targeted runs for specific changes, enable parallelism with -parallelism flag, and store state in performant backends. Caching provider data and limiting data source calls also help. Interviewers expect you to balance speed with consistency and state integrity.
Common mistakes
- Hard‑coding resource IDs instead of using data sources
- Storing sensitive values directly in state files
- Neglecting remote state locking leading to race conditions
- Overusing provisioners, causing drift and non‑idempotent runs
Study plan
- Read the official Terraform documentation on state, backends, and modules
- Practice writing reusable modules and version them in a private registry
- Set up a remote backend (S3 + DynamoDB) and simulate team collaboration
- Implement CI pipelines that run terraform fmt, validate, plan, and apply with policy checks
- Run Terratest scenarios to validate infrastructure changes before production
FAQ
Do I need to know HCL syntax for Terraform interviews?
Yes. Interviewers expect you to write and read HCL confidently, explain resource blocks, variables, and interpolation. Being able to debug syntax errors quickly demonstrates practical proficiency.
How important is cloud provider knowledge when answering Terraform questions?
Very important. Terraform is a multi‑cloud tool, but interviewers often focus on the provider you’ll manage (AWS, Azure, GCP). Show how Terraform abstracts resources while still requiring provider‑specific concepts.
Can I use Terraform Cloud for personal projects?
You can, but most interview scenarios assume open‑source Terraform with a remote backend. Understanding both shows flexibility and awareness of enterprise features.
What is the best way to demonstrate Terraform expertise on a resume?
List specific projects with details: number of resources managed, remote backend used, CI integration, and any policy‑as‑code implementations. Quantify impact, such as reduced deployment time or improved reliability.
Should I memorize all Terraform commands?
Focus on the most common ones—init, plan, apply, destroy, fmt, validate, import, and state subcommands. Understanding their purpose and typical flags is more valuable than rote memorization.
Related
Ready for your next interview?
Download MiPrep AI. Load your resume and the job description. Show up ready.
Free tier · No credit card · macOS 14+ · Windows 10+
Free tier · No credit card · Runs on your Mac or Windows machine