Terraform interviews focus on state, because most real problems come from state: who holds it, who can change it at the same time, and what happens when reality drifts away from it. After that come modules, environments, safe changes, and how you'd run Terraform in a team.
Below are 25 questions with answers. HashiCorp changed Terraform's license in 2023, and the community fork OpenTofu exists, so mention which one the team uses if it comes up. The core ideas and commands are the same for both.
Basics
1. What is Terraform, and what is infrastructure as code?
Terraform is a tool for defining infrastructure in configuration files and applying it through provider APIs. Infrastructure as code means the setup is written down, versioned, reviewed, and repeatable, instead of being clicked together in a console.
2. What's the difference between declarative and imperative?
Terraform is declarative: you describe the end state you want, and Terraform works out the steps. With an imperative script, you write the steps yourself, and running it twice may break things.
3. What are the main Terraform commands?
| Command | What it does |
|---|---|
| terraform init | Downloads providers and modules, sets up the backend |
| terraform validate | Checks the configuration is valid |
| terraform fmt | Formats the files |
| terraform plan | Shows what will change |
| terraform apply | Makes the changes |
| terraform destroy | Removes the managed resources |
| terraform import | Brings an existing resource under management |
| terraform state | Inspects and edits state |
4. What are providers, resources, and data sources?
A provider is a plugin that talks to an API such as AWS, Azure, or Kubernetes. A resource is something Terraform creates and manages. A data source reads information about something that exists already, such as an existing VPC or the latest AMI.
5. What are variables, outputs, and locals?
Input variables parameterize a configuration. Outputs expose values, for use on the command line or by other modules. Locals are named expressions inside a module, used to avoid repeating yourself.
State
6. What is the Terraform state file, and why does it matter?
State maps your configuration to real resources and stores their attributes. Terraform compares the configuration, the state, and the real world to plan changes. Lose the state and Terraform may try to recreate things that exist. It can also contain secrets, so treat it as sensitive.
7. Where should state be stored?
In a remote backend, not on one person's laptop, for example S3 with a DynamoDB table or the newer native S3 lock, Azure Storage, Google Cloud Storage, or Terraform Cloud. Enable versioning on the bucket, encryption, and restricted access.
8. What is state locking?
It stops two people or pipelines from applying at the same time and corrupting state. Most remote backends support it. If a run crashes, you may need to release a stale lock with terraform force-unlock, after checking that nobody is still applying.
9. What is drift, and how do you handle it?
Drift is when real infrastructure differs from state, usually because someone changed it by hand. terraform plan (or plan -refresh-only) shows it. Decide whether to revert the change by applying, or to update the code to match.
10. How do you bring an existing resource under Terraform?
Write the resource block, then run terraform import <address> <id>, or use an import block in newer versions. Run plan afterward and adjust the code until it shows no changes.
11. How do you split state across environments or teams?
Use separate state per environment and component, for example one for networking, one for each app, and one per environment. This limits the blast radius and speeds up plans. Share values using outputs and data sources or remote state.
Modules and structure
12. What is a module, and when do you write one?
A module is a reusable group of resources with inputs and outputs. Write one when you repeat the same pattern, such as a VPC or a service, and want a single reviewed version. Keep modules small and focused, with sensible defaults, and version them.
13. How do you manage dev, staging, and production?
Common options are separate directories or repos with their own state and variable files, or workspaces. Many teams prefer separate state per environment, since workspaces share the same code and make it easy to apply to the wrong one. Use the same modules with different variable values.
14. What are workspaces?
Named states within one backend and configuration. They're useful for temporary copies of the same setup, such as per-branch test environments, but are not a strong separation for production.
15. What's the difference between count and for_each?
count creates a number of copies indexed by position. for_each creates one per item in a map or set, keyed by name. Prefer for_each, because removing an item from the middle of a count list shifts the indexes and can destroy and recreate resources.
16. What does depends_on do?
It adds an explicit dependency when Terraform can't see it from references. Use it sparingly, since most dependencies come from referring to another resource's attributes.
Safe changes and operations
17. What are lifecycle rules?
create_before_destroy makes a replacement first, prevent_destroy blocks deletion, ignore_changes skips attributes changed outside Terraform, and replace_triggered_by forces replacement when another resource changes.
18. How do you handle secrets in Terraform?
Don't hard-code them. Use a secrets manager or environment variables, mark variables and outputs as sensitive, and remember that values can still end up in state, so protect the state. Avoid passing secrets through plain variable files in version control.
19. How do you review and apply changes safely?
Run plan in a pull request, review the plan output, require approval, and apply from a pipeline using the saved plan so what's reviewed is what runs. Watch for destroy or replace lines in the plan.
20. A plan shows it will destroy and recreate a database. What do you do?
Stop and find out why. Common causes are a changed immutable attribute, a renamed resource, or a moved module. Use moved blocks or terraform state mv to fix address changes, use ignore_changes or prevent_destroy if appropriate, and take a backup before any risky apply.
21. How do you rename or move a resource without destroying it?
Use a moved block in the code, or terraform state mv to change its address in state. Then run plan and confirm there's no destroy.
22. How do you pin versions?
Use required_version for Terraform and required_providers with version constraints, and commit the .terraform.lock.hcl file so everyone uses the same provider builds. Upgrade deliberately and read the changelog.
Practical and scenario questions
23. What are provisioners, and should you use them?
Provisioners run scripts on a resource after creation. They're a last resort, because they're not tracked in state and failures are hard to handle. Prefer cloud-init, images built with a tool such as Packer, or configuration management.
24. How would you structure Terraform for a team with several environments?
"A repo for shared modules with versioned releases, and a live repo with a directory per environment and component. Each has its own remote state with locking. A pipeline runs fmt, validate, and plan on pull requests, requires approval, and applies on merge. Access is through short-lived credentials, and policy checks catch risky changes."
25. Someone changed a resource in the console and now Terraform wants to revert it. What do you do?
Find out why they changed it. If it was an urgent fix, update the code to match and apply, so the change is kept. If it was a mistake, apply to revert it. Then add controls, such as restricting console write access, so it doesn't happen again.
How to prepare
Create a small project with a remote backend, a module, and two environments. Practice a rename with a moved block, an import, and a drift fix. Be ready to explain a time a plan surprised you and what you did. For related cloud topics, see our AWS interview guide and Kubernetes guide.
Say your answers out loud, particularly the state questions, where explanations get muddled. A mock interview transcript shows where you hesitated. Follow the employer's rules on AI tools in any live interview.
Practice Terraform interview answers with YesToTheOffer
Run a mock technical interview, explain state and modules out loud, and review your transcript afterward. 30 free minutes, no subscription.
