--- title: "Terraform Associate Flashcards (TA-003)" description: "Full exam coverage for the HashiCorp Certified Terraform Associate (TA-003) exam using spaced repetition. Covers IaC concepts, CLI, HCL, state, modules, backends, and Terraform Cloud." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/terraform-associate-ta003-flashcards --- # Terraform Associate Flashcards (TA-003) ## Flashcards ### 1. What is Infrastructure as Code (IaC)? The practice of defining and provisioning infrastructure through machine-readable configuration files rather than manual processes, so infrastructure can be versioned, reviewed, and reproduced consistently. ### 2. What are the main benefits of using IaC? Repeatable and consistent provisioning, version control of infrastructure, easier collaboration and code review, faster environment creation, and reduced human error compared to manual clicking. ### 3. What is the difference between declarative and imperative infrastructure? Declarative describes the desired end state and lets the tool figure out how to reach it. Imperative specifies the exact steps to execute. Terraform is declarative. ### 4. What does idempotency mean in Terraform? Applying the same configuration repeatedly produces the same result. If the real infrastructure already matches the config, a second apply makes no changes. ### 5. How does Terraform differ from configuration management tools like Ansible or Chef? Terraform provisions and manages the lifecycle of infrastructure resources. Configuration management tools focus on installing and configuring software on existing machines. They are often used together. ### 6. What is a Terraform provider? A plugin that lets Terraform interact with an API, such as AWS, Azure, GCP, or Kubernetes. Providers expose resources and data sources for that platform. ### 7. What are the core commands of the standard Terraform workflow? terraform init to initialize, terraform plan to preview changes, terraform apply to make changes, and terraform destroy to tear down managed infrastructure. ### 8. What does terraform init do? Initializes the working directory, downloads provider plugins and modules, and configures the backend. It must run before plan or apply in a new or changed configuration. ``` terraform init ``` ### 9. What does terraform plan do? Creates an execution plan showing what actions Terraform will take to reach the desired state, comparing the configuration against current state without making any changes. ### 10. What does terraform apply do? Executes the actions proposed in a plan to create, update, or delete resources so the real infrastructure matches the configuration. It prompts for approval unless auto-approved. ### 11. What does terraform destroy do? Removes all infrastructure managed by the current configuration and state. It is equivalent to a plan and apply that deletes every managed resource. ### 12. How do you save a plan and apply exactly that plan later? Run terraform plan with the -out flag to save the plan to a file, then pass that file to terraform apply so it applies precisely those actions with no re-prompt. ``` terraform plan -out=tfplan terraform apply tfplan ``` ### 13. What is HCL? HashiCorp Configuration Language, the declarative language used to write Terraform configurations. It is designed to be both human-readable and machine-friendly. ### 14. How do you declare an input variable in Terraform? Use a variable block with an optional type, default, and description. Values can be set via defaults, tfvars files, environment variables, or the command line. ``` variable "region" { type = string default = "us-east-1" } ``` ### 15. What is a local value and when is it useful? A local, defined in a locals block, assigns a name to an expression so it can be reused within a module. It reduces repetition but is not settable from outside the module. ``` locals { name_prefix = "app-${var.env}" } ``` ### 16. What are output values used for? Outputs expose values from a module, such as an IP or resource ID, for display after apply, for use by a parent module, or for reading from remote state. ``` output "instance_ip" { value = aws_instance.web.public_ip } ``` ### 17. What is a data source? A read-only query that fetches information about existing infrastructure or external data, defined with a data block, without managing that resource. ``` data "aws_ami" "ubuntu" { most_recent = true owners = ["099720109477"] } ``` ### 18. How do you reference the attribute of a resource in an expression? Use the syntax resource_type.name.attribute for managed resources and data.type.name.attribute for data sources. ### 19. What is the order of precedence for setting variable values? From lowest to highest, defaults, environment variables, terraform.tfvars, terraform.tfvars.json, auto.tfvars files in lexical order, then -var and -var-file on the command line, which win. ### 20. What does terraform fmt do? Rewrites configuration files to the canonical HCL formatting and style, fixing indentation and alignment so code is consistent across a team. ``` terraform fmt -recursive ``` ### 21. What does terraform validate check? It verifies that the configuration is syntactically valid and internally consistent, independent of any providers, remote state, or actual infrastructure. ### 22. What does terraform import do? Brings an existing, unmanaged resource under Terraform management by writing it into state, mapping the real object to a resource address you already declared. ``` terraform import aws_instance.web i-1234567890abcdef0 ``` ### 23. What did terraform taint do and what replaces it? taint marked a resource for recreation on the next apply. It is deprecated in favor of terraform apply -replace, which is the recommended way to force recreation. ``` terraform apply -replace="aws_instance.web" ``` ### 24. What does terraform state list do? Lists all resource addresses currently tracked in the state file, useful for finding the exact address to target, move, or remove. ``` terraform state list ``` ### 25. What is a Terraform workspace? A named, separate state instance within a single backend and configuration, letting you manage multiple states such as dev and prod from the same code. ``` terraform workspace new dev terraform workspace select dev ``` ### 26. What does terraform show do? Displays human-readable output of the current state or a saved plan file, useful for inspecting attributes and reviewing what a plan will change. ### 27. What does the -target flag do and when should you use it? It limits plan or apply to a specific resource and its dependencies. It is meant for exceptional recovery situations, not routine use, because it can create inconsistent state. ### 28. How do you see the outputs defined in a configuration after apply? Run terraform output to print all outputs, or terraform output NAME for a single value. Add -json for machine-readable output. ``` terraform output instance_ip ``` ### 29. What is a Terraform module? A container for multiple resources used together, defined by a directory of .tf files. It is called with a module block and enables reuse and organization of configuration. ### 30. What is the root module? The working directory where you run Terraform. It is the top-level module that can call other child modules via module blocks. ### 31. What sources can a module be loaded from? Local paths, the Terraform Registry, Git and other VCS repositories, HTTP URLs, and S3 or GCS buckets, specified in the module block's source argument. ``` module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "5.0.0" } ``` ### 32. How do you pass values into a child module and get values back? Pass values as arguments in the module block that map to the module's input variables, and read the module's outputs with module.NAME.OUTPUT. ### 33. How do you pin a module to a specific version? Use the version argument in the module block for registry modules, or a ref query on a Git source. Pinning prevents unexpected changes from upstream updates. ### 34. Why should module versions be constrained? To ensure reproducible builds. Without a version constraint a new upstream release could change behavior on the next init and unexpectedly alter infrastructure. ### 35. How do you create multiple instances of a module? Use the count or for_each meta-argument on the module block. for_each iterates over a map or set, giving each instance a stable key. ### 36. Can you define custom functions in Terraform? No. Terraform only provides its built-in functions. There is no way to write user-defined functions in HCL. ### 37. What does the lookup function do? It retrieves the value of a key from a map, returning a default when the key is absent, which avoids errors on missing keys. ``` lookup(var.amis, var.region, "ami-default") ``` ### 38. What do the join and split functions do? join concatenates the elements of a list into a string with a separator. split does the reverse, breaking a string into a list on a separator. ``` join(",", ["a", "b"]) split(",", "a,b") ``` ### 39. What does the element function do and how does it handle indexes? It returns the item at a given index in a list and wraps around using modulo, so an index beyond the list length cycles back to the start. ``` element(["a", "b", "c"], 1) ``` ### 40. What does the file function do? It reads the contents of a file at a given path and returns it as a string, commonly used to load scripts, policies, or user data. ``` file("${path.module}/init.sh") ``` ### 41. How do you test and explore functions interactively? Use terraform console, an interactive REPL where you can evaluate expressions, functions, and references against the current state. ``` terraform console ``` ### 42. What is Terraform state and why is it needed? State is a file mapping resources in the configuration to real-world objects. Terraform needs it to track metadata, detect drift, and plan changes efficiently. ### 43. Where is state stored by default? In a local file named terraform.tfstate in the working directory, unless a remote backend is configured to store it elsewhere. ### 44. What is state locking and why does it matter? Locking prevents concurrent operations from writing to state at the same time, which would corrupt it. Supported backends acquire a lock during apply and release it after. ### 45. What is configuration drift? When the real infrastructure differs from what is recorded in state, usually from manual changes. terraform plan detects drift by refreshing and comparing. ### 46. How does Terraform handle sensitive values in state? State can contain secrets in plain text, so it must be protected. Mark outputs and variables as sensitive to hide them from CLI output, and encrypt and restrict access to the state backend. ### 47. What does terraform state mv do? It renames or moves a resource within state, for example after refactoring a resource address or moving it into a module, without destroying and recreating it. ``` terraform state mv aws_instance.a aws_instance.b ``` ### 48. What does terraform state rm do? It removes a resource from state so Terraform stops managing it, without destroying the real infrastructure. The object continues to exist untracked. ``` terraform state rm aws_instance.web ``` ### 49. What does terraform refresh do and how has it changed? It updates state to match real infrastructure. The standalone command is deprecated. Refresh now happens automatically during plan and apply, and can be skipped with -refresh=false. ### 50. How do you read outputs from another configuration's state? Use the terraform_remote_state data source, pointing it at the backend and workspace of the other configuration, then reference its outputs attribute. ``` data "terraform_remote_state" "net" { backend = "s3" config = { bucket = "tf-state", key = "net" } } ``` ### 51. Why should you avoid editing the state file by hand? The state file is a structured JSON document that Terraform relies on for consistency. Manual edits can corrupt it. Use terraform state subcommands instead. ### 52. What is a backend in Terraform? A backend determines where state is stored and how operations run. The default is local, while remote backends like S3 or Terraform Cloud store state centrally. ### 53. Why use a remote backend instead of local state? It enables team collaboration on shared state, keeps state off individual laptops, supports locking, and can keep sensitive state encrypted and access-controlled. ### 54. How does the S3 backend provide state locking? The S3 backend uses a DynamoDB table for lock records. Recent Terraform versions also support S3-native locking with the use_lockfile option instead of DynamoDB. ``` terraform { backend "s3" { bucket = "tf-state" key = "prod/terraform.tfstate" dynamodb_table = "tf-locks" } } ``` ### 55. What happens when you change backends? Terraform detects the backend change on init and offers to migrate existing state to the new backend, so state is not lost when moving from local to remote. ### 56. Can backend configuration contain variables or expressions? No. Backend blocks must be static. Values can be supplied at init time with -backend-config flags or a backend config file, but not through interpolation. ``` terraform init -backend-config=prod.backend.hcl ``` ### 57. What is Terraform Cloud? A managed HashiCorp service that stores state, runs plans and applies remotely, manages variables and secrets, and adds collaboration, policy, and access controls on top of Terraform. ### 58. What is a workspace in Terraform Cloud? A managed environment that holds its own state, variables, and run history for a configuration. It differs from CLI workspaces, which are just multiple states in one backend. ### 59. What are the execution modes in Terraform Cloud? Remote runs plan and apply on Terraform Cloud infrastructure, local uses Terraform Cloud only for state while running on your machine, and agent runs on a self-hosted agent. ### 60. What are variable sets in Terraform Cloud? Reusable collections of variables that can be applied to multiple workspaces at once, so shared credentials or settings do not have to be defined per workspace. ### 61. What is Sentinel in the HashiCorp ecosystem? A policy-as-code framework used in Terraform Cloud and Enterprise to enforce governance rules on runs, such as blocking untagged resources, before an apply proceeds.