Top 40 Terraform Interview Questions (2026)

Terraform is asked in almost every DevOps/Cloud
interview. Here are the most important questions.

Beginner Questions

Q: What is Terraform?
Open-source IaC tool by HashiCorp. Provisions
infrastructure using declarative HCL configuration.
Supports 1000+ providers (AWS, Azure, GCP, K8s).

Q: What is terraform init?
Downloads provider plugins, initializes backend,
creates .terraform directory. Run first and after
any provider changes.

Q: Difference between terraform plan and apply?
plan: shows what will change WITHOUT making changes.
apply: executes the plan after confirmation.
Always review plan before apply in production!

Q: What is Terraform state?
terraform.tfstate maps HCL config to real resource IDs.
Source of truth for what Terraform manages.
Store remotely (S3 + DynamoDB) in teams.

Q: What are Terraform providers?
Plugins that interface with cloud APIs.
Examples: hashicorp/aws, hashicorp/azurerm,
hashicorp/kubernetes. Declared in required_providers.

Intermediate Questions

Q: count vs for_each — which to prefer?
for_each: creates resources with stable string keys.
Removing one key only destroys that resource.
count: indexed numerically, removing middle item
causes destroy+recreate cascade.
Always prefer for_each!

Q: How do you handle secrets in Terraform?
Never hardcode in .tf files (goes into state!).
Use: environment variables (TF_VAR_password),
AWS Secrets Manager data source,
HashiCorp Vault provider,
OIDC for passwordless cloud auth in CI/CD.

Q: What is remote state and why use it?
Stores tfstate in S3/Terraform Cloud instead of locally.
Benefits: team sharing, DynamoDB locking prevents
concurrent applies, versioned, encrypted, backed up.

Q: What are Terraform modules?
Reusable collection of resources with defined inputs
and outputs. Call with module block, access outputs
via module.name.output_name.

Q: How do you import existing resources?
terraform import resource_type.name resource_id
Brings manually created resources under Terraform
management without recreating them.

Advanced Questions

Q: How do you implement Terraform in CI/CD?
PR: terraform fmt --check, validate, plan (post as comment)
Merge: terraform apply saved plan
Use OIDC for authentication — no stored AWS keys!
Tools: Atlantis, Terraform Cloud, GitHub Actions.

Q: What is infrastructure drift?
Real infrastructure deviates from Terraform state
due to manual console changes.
Detection: terraform plan shows drift.
Prevention: no manual changes, scheduled plan in CI.

Q: How do you rollback in Terraform?
No native rollback command. Options:

Git revert .tf files, run apply
Restore previous state from S3 versioning
terraform destroy -target specific resource

Q: What is Terraform Sentinel?
Policy-as-code framework in TF Cloud/Enterprise.
Enforces compliance before apply runs.
Use cases: require tags, cost limits, security rules.

...and 26 more questions with answers 👇

🔗 Full Q&A + PDF Download:
devopsrise.vercel.app/qa

Quick Reference

Command	Purpose
terraform init	Initialize providers
terraform plan	Preview changes
terraform apply	Apply changes
terraform destroy	Destroy resources
terraform state list	List resources
terraform import	Import existing
terraform fmt	Format code
terraform validate	Validate config