Terraform interview questions mostly test five areas: how state works, the core workflow, modules and variables, team practices such as remote backends and locking, and how you handle drift or a failed apply. This guide collects 32 questions that freshers and engineers with up to three years of experience are commonly asked, with short answers and small HCL examples you can try yourself.
Key takeaways
- Terraform keeps a state file that maps your code to real cloud resources, and most interview questions come back to state.
- The core workflow is init, plan and apply, and you should always read the plan before you apply it.
- Teams store state in a remote backend with locking so two people cannot change the same infrastructure at once.
- Modules, variables and outputs are how you reuse Terraform code across environments.
- Expect scenario questions on drift, importing existing resources and recovering from a half-finished apply.
Treat each answer as a starting point. Run the commands on a free-tier cloud account or locally with a provider such as local or random, because interviewers often ask what you saw when you tried it. If you are new to the wider field, read our DevOps roadmap first, and pair this list with our DevOps interview questions.
Terraform basics
1. What is Terraform?
Terraform is an infrastructure as code (IaC) tool from HashiCorp. You describe servers, networks, databases and other resources in configuration files, and Terraform creates, changes or destroys them through the APIs of cloud providers such as AWS, Azure and Google Cloud.
2. What is infrastructure as code and why does it matter?
Infrastructure as code means managing infrastructure through version-controlled files instead of clicking in a console. It gives you repeatable environments, code review for infrastructure changes, a history of who changed what, and the ability to rebuild an environment from scratch.
3. Is Terraform declarative or imperative?
Declarative. You describe the end state you want, such as three subnets and one load balancer, and Terraform works out the steps needed to reach it. You do not write the order of API calls yourself.
4. What language does Terraform use?
Terraform uses HCL, the HashiCorp Configuration Language. Files end in .tf. Terraform can also read JSON configuration (.tf.json), which is useful when another program generates the configuration.
5. What is a provider?
A provider is a plugin that lets Terraform talk to a particular API, such as aws, azurerm, google or kubernetes. You declare required providers and their versions, and terraform init downloads them.
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
}
}
provider "aws" {
region = "ap-south-1"
}6. What is a resource block?
A resource block declares one piece of infrastructure that Terraform manages. It has a type and a local name, and Terraform tracks it in state.
resource "aws_s3_bucket" "logs" {
bucket = "myteam-app-logs-dev"
}7. What is the difference between a resource and a data source?
A resource is something Terraform creates and manages. A data source only reads information about something that already exists, such as the latest Ubuntu AMI or an existing VPC, so you can use its attributes without managing it.
Terraform workflow and commands
8. Explain the core Terraform workflow.
Write configuration, run terraform init to download providers and set up the backend, run terraform plan to see what will change, then terraform apply to make the changes. terraform destroy removes everything the configuration manages.
9. What does terraform plan do?
It refreshes Terraform's view of real infrastructure, compares it with your configuration and shows the actions it would take: create, update in place, replace or destroy. It changes nothing. In pipelines you often save it with terraform plan -out=tfplan and then apply exactly that file.
10. What do the symbols in a plan mean?
A plus sign means create, a minus sign means destroy, a tilde means update in place, and minus followed by plus means the resource must be destroyed and recreated, usually because you changed an attribute that cannot be updated in place.
11. What are terraform fmt and terraform validate used for?
terraform fmt rewrites files into the standard style. terraform validate checks that the configuration is syntactically valid and internally consistent. Both are cheap to run and belong in every CI pipeline before plan.
12. What is terraform output?
It prints the values of output blocks from state, such as a load balancer DNS name or a database endpoint. Other tools and scripts often read these values.
Terraform state
13. What is the Terraform state file?
terraform.tfstate is a JSON file that records which real resources belong to which blocks in your configuration, along with their attributes. Terraform uses it to work out what has changed and what needs to be done. Without state, Terraform would not know that a bucket in your account is the one declared in your code.
14. Why should you not keep state on your laptop or in Git?
Local state cannot be shared safely with a team, and it is easy to lose. State can also contain sensitive values such as database passwords in plain text, so committing it to Git is a security risk. Use a remote backend instead.
15. What is a remote backend?
A backend decides where state is stored. Common remote backends are an S3 bucket, Azure Storage, Google Cloud Storage or HCP Terraform. A remote backend keeps one shared copy of state and usually supports locking and encryption.
terraform {
backend "s3" {
bucket = "myteam-tf-state"
key = "network/dev.tfstate"
region = "ap-south-1"
use_lockfile = true
encrypt = true
}
}Older setups used a DynamoDB table for S3 locking. Newer Terraform versions support S3 native locking, so check the official documentation for the version your team uses.
16. What is state locking?
Locking stops two runs from writing to the same state at the same time. When one person runs apply, the backend holds a lock, and a second run waits or fails instead of corrupting state.
17. What is drift and how do you detect it?
Drift is when real infrastructure no longer matches the configuration, usually because someone changed something manually in the console. Running terraform plan shows the difference. You then either update the code to match or apply to bring the resource back in line.
18. How do you bring an existing resource under Terraform?
Write a matching resource block and import the real object into state. Modern Terraform supports an import block inside configuration, which can be planned and reviewed like any other change. The older terraform import command still works.
import {
to = aws_s3_bucket.logs
id = "myteam-app-logs-dev"
}19. Which terraform state commands have you used?
terraform state list shows resources in state, terraform state show prints one resource, terraform state mv renames or moves a resource address, and terraform state rm stops Terraform tracking a resource without destroying it. For renames, a moved block in configuration is now the safer, reviewable option.
Variables, outputs and modules
20. How do input variables work?
You declare variables with a type, description and optional default, then pass values through a .tfvars file, environment variables starting with TF_VAR_, or the -var flag.
variable "instance_type" {
type = string
description = "EC2 size for the app server"
default = "t3.micro"
}21. What is the difference between a variable and a local value?
Variables are inputs supplied from outside the module. Locals are named expressions calculated inside the module, such as a common set of tags or a name prefix, so you do not repeat the same expression everywhere.
22. What is a module?
A module is a folder of Terraform files used as a reusable unit. Every configuration is the root module, and it can call child modules from a local path, a Git repository or a registry. Teams build modules for common patterns such as a VPC or an EKS cluster and call them for each environment.
module "network" {
source = "./modules/vpc"
cidr_block = "10.10.0.0/16"
env = "dev"
}23. How do you mark a value as sensitive?
Set sensitive = true on a variable or output so Terraform hides it in plan and apply output. It is still stored in state, which is why state must be protected.
24. What are count and for_each, and when do you use each?
Both create multiple instances of a resource. count uses a number and index, which is fine for identical copies. for_each uses a map or set of strings, so each instance has a stable key. Prefer for_each when items can be added or removed, because removing an item from the middle of a count list shifts indexes and can force unwanted replacements.
25. What is depends_on?
Terraform builds a dependency graph from references between resources. depends_on adds an explicit dependency when there is a hidden relationship that Terraform cannot see from references. Use it sparingly.
26. What are lifecycle rules?
The lifecycle block changes default behaviour. create_before_destroy builds a replacement before deleting the old resource, prevent_destroy blocks accidental deletion of something critical, and ignore_changes tells Terraform to ignore attributes that another system updates.
Team practices and scenarios
27. How do you manage dev, test and production environments?
Two common patterns exist. One uses a separate folder and state per environment that calls shared modules with different variables. The other uses Terraform workspaces. Many teams prefer separate folders and backends for production because the isolation is clearer and mistakes are less likely.
28. What are workspaces?
Workspaces let one configuration keep several separate state files. terraform workspace new staging creates one, and terraform.workspace can be used in expressions. They suit short-lived copies of the same stack more than strongly separated environments.
29. How would you run Terraform in a CI/CD pipeline?
Run fmt -check, validate and plan on every pull request, and post the plan for review. After approval, apply the saved plan from the main branch using a service identity with only the permissions it needs. Never store cloud keys in the repository.
30. An apply failed halfway. What do you do?
Do not panic or delete state. Read the error, fix the cause, and run plan again. Terraform records what it managed to create, so the next plan shows only the remaining work. If a lock is stuck because a run crashed, confirm nobody else is running and then use terraform force-unlock with the lock ID.
31. What is the difference between Terraform and Ansible?
Terraform is mainly for provisioning infrastructure and tracks it in state. Ansible is mainly for configuring servers and deploying software over SSH, and it does not keep state in the same way. Many teams use Terraform to create machines and Ansible to configure them.
32. What is the difference between Terraform and OpenTofu?
HashiCorp moved Terraform to the Business Source License in 2023. OpenTofu is a community fork of the earlier open-source code, managed under the Linux Foundation, and it keeps a very similar language and workflow. For licence details and feature differences, check the official sites of both projects.
How to prepare for a Terraform interview
- Build one small project end to end: a VPC, a subnet, a security group and a virtual machine, with state in a remote backend.
- Break it on purpose. Change something in the console and watch plan detect the drift.
- Refactor it into a module and call it twice with different variables.
- Practise explaining state in two or three plain sentences, because almost every interviewer asks.
If you also expect container questions, revise with our Docker tutorial for beginners and Kubernetes interview questions.
Frequently asked questions
Is Terraform hard to learn for freshers?
No. The syntax is small, and most freshers can write useful configuration within a week or two. The harder part is understanding cloud networking and state, which comes with practice.
Which Terraform certification should I take?
HashiCorp offers the Terraform Associate certification for beginners. Exam versions and fees change, so check the official HashiCorp certification page before you book.
Do I need to know a cloud platform before Terraform?
Yes, at least the basics of one. Terraform only automates what the cloud offers, so you should understand compute, networking, storage and identity on AWS, Azure or Google Cloud first.
What are the most common Terraform interview topics?
State and remote backends, the init, plan and apply workflow, modules and variables, count versus for_each, drift and import, and how Terraform fits into a CI/CD pipeline.
Find more guides on tools, pipelines and interviews in our DevOps articles.
