004 quick review

Memory hook: Describe the destination; review the journey.

Must remember

• Declarative configuration describes the desired infrastructure. Terraform compares configuration, recorded identity and provider observations to propose changes. Reapplying unchanged configuration should converge without unnecessary replacement.
• Version control makes changes reviewable. A pull request can show a plan before approval; reusable modules make standards easier to repeat. Configuration still needs testing, credentials and operational ownership.
• Multi-cloud means providers can manage several APIs in one workflow. It does not translate an AWS resource into an equivalent Azure resource. Resource schemas and architecture remain platform-specific.
• Hybrid infrastructure can combine cloud services, DNS, SaaS and supported on-premises APIs. Terraform is primarily a provisioning tool; image building and application configuration may use Packer or a configuration-management system.
• Immutable replacement creates a new object when an attribute cannot change in place. A small code change can therefore have a large availability or data impact. Read the actual plan, including deletions.

Recall drill: explain how a hand-edited production setting becomes drift and why rerunning an imperative script is not the same as comparing desired state.

Choose under exam pressure

Traps

• A successful plan is not proof that the application will function.
• Code review does not replace review of replacements and destructive actions.

Practise this topic

Memory hook: Provider talks; state remembers.

Must remember

• A provider is a plugin implementing resource and data-source operations for an API. Terraform Core handles language evaluation and the dependency graph; it delegates API behavior to providers.
• required_providers declares source addresses and allowed versions. A provider block supplies a configuration such as region or endpoint. required_version constrains Terraform itself, not a provider.
• terraform init installs providers. Commit .terraform.lock.hcl so colleagues reuse selected provider versions and verified checksums. The lock file does not lock remote module versions.
• ~> 6.2 permits later 6.x releases; ~> 6.2.0 permits later 6.2.x patches. init -upgrade reselects versions within constraints, so review the lock-file diff.
• Multiple configurations of one provider use alias; select one with provider = aws.secondary. Child modules receive aliases through an explicit providers mapping and declare expected aliases.
• A Terraform resource address identifies a configured instance, such as module.web.aws_instance.node["blue"]. State connects that address to the remote object identifier. Renaming an address without a move declaration can look like delete-and-create.

Choose under exam pressure

Traps

• A provider alias is not a separate state file.
• An omitted default provider configuration can produce an empty default configuration, which may lack required settings.

Practise this topic

Memory hook: Format, initialise, validate, plan, then approve.

Must remember

+ means create, ~ update, - destroy and a combined delete/create marker means replacement. Values marked unknown become known later. A plan without -out is a preview; a later apply creates a fresh plan.

Practice on paper: trace a provider upgrade, a module-source change and an input change through this sequence. These notes do not ask you to run apply or destroy against a cloud account.

Choose under exam pressure

Traps

• Plan can read remote APIs and acquire a lock; it is not always offline.
• Destroy cannot remove resources that Terraform has forgotten or never managed.

Practise this topic

Memory hook: References connect; sensitive only conceals.

Must remember

• Resources manage object lifecycles; data sources read information. References such as aws_subnet.app.id normally create implicit dependencies. Use depends_on for real hidden ordering requirements, not every relationship.
• Variables are module inputs; locals name derived expressions; outputs expose results. In the CLI, explicit -var/-var-file options override automatic variable files and environment variables. Child modules receive arguments from their caller.
• Types include string, number, bool, lists, sets, maps, tuples and objects. A set removes duplicates and has no index ordering. for transforms values; a dynamic block generates nested blocks; count and for_each create resource/module instances.
• count uses numeric addresses. for_each uses known map keys or set-of-string elements, which are more stable when items are removed. Sensitive or apply-time-unknown values cannot serve as identity keys.
• Variable validation checks input constraints. Preconditions check assumptions before an operation; postconditions check results. A failed check assertion reports a warning rather than blocking the operation like a failed precondition.
• sensitive = true redacts ordinary display but does not itself remove a value from state. Use secure remote storage and least-privilege access. Vault can supply short-lived secrets; retrieving a secret does not automatically keep it out of state.
• Terraform 1.10 introduced ephemeral values; 1.11 added write-only resource arguments, where supported by providers. These reduce persistence in permitted contexts. Do not assume every normal argument accepts ephemeral data.

Choose under exam pressure

Traps

• Marking an output sensitive is not encryption.
• Broad depends_on can make more values unknown and cause unnecessary conservative plans.

Practise this topic

Memory hook: Inputs in; outputs out; versions explicit.

Must remember

A module is a directory of Terraform configuration. The directory where you execute Terraform is the root module; its module blocks call child modules. File names such as main.tf are conventions: Terraform loads the directory’s configuration together.

A child module has its own variable scope. It cannot read a root variable simply because the name matches. Pass region = var.region or another explicit argument; read results through module.network.subnet_ids when the child declares that output.

Module sources may be local paths, registry addresses, version-controlled repositories or supported archives. Registry modules support the version argument. A Git source can pin a tag or commit with ?ref=...; a local module has no independently downloaded version. Rerun init after changing module sources or selected versions.

Prefer small modules that expose useful architecture choices and compose through outputs. Do not put provider configuration inside a reusable module when the caller should control accounts and regions. Provider requirements belong in the child; provider configurations normally come from the root.

Recall drill: sketch two calls to the same VPC module, with different CIDRs. Explain why their resource addresses differ and why their input values do not leak into each other.

Choose under exam pressure

Traps

• The provider lock file does not pin a registry module.
• A module is a code boundary, not automatically a state or security boundary.

Practise this topic

Memory hook: One binding, one writer, protected history.

Must remember

State maps configured instances to remote object IDs and stores attributes needed for planning. The default local backend uses a local state file. Remote backends place state in shared storage; locking, encryption and access-control behavior depend on the selected backend.

Locking prevents concurrent writers corrupting a state snapshot. Do not disable locks just to get past a busy run. Force-unlock is a recovery operation for your own stale lock after confirming no writer remains. It does not roll back infrastructure.

Configure storage in a backend block; backend configuration cannot refer to normal variables or resource outputs. Supply authentication through the recommended external credential mechanism. Hard-coded or command-line backend secrets may be cached or captured in plans. init -migrate-state transfers state after a reviewed backend change; -reconfigure treats the configuration as new rather than migrating existing state.

Drift is found when providers read real objects during planning. Decide whether configuration should restore the intended value or be updated to accept the external change. A refresh-only plan proposes state/output updates without proposing remote infrastructure changes; applying it still writes state.

CLI workspaces provide separate state instances for one configuration, but shared credentials/backend access can remain. Use separate roots and permissions when environments need strong isolation. Consumers of terraform_remote_state need access to the underlying snapshot, even though the data source exposes only root outputs.

Choose under exam pressure

Traps

• Remote state storage does not always mean remote execution.
• Copying state into Git exposes historical secrets and provides poor locking.

Practise this topic

Memory hook: Import adopts; move renames; remove forgets.

Must remember

• Import associates an existing remote object with a resource address. The CLI import command updates state but does not write a complete matching configuration. Configuration-driven import blocks allow adoption to appear in a plan; review any generated configuration before applying it.
• Import one real object into one managed address. After adoption, plan again: missing or different arguments can propose changes or replacement. Import is not a backup and does not discover an entire application automatically.
• A moved block records an address change, such as moving a resource into a module, so Terraform can retain its identity. Keep historical moves for consumers who upgrade from older module versions.
• terraform state list shows addresses; state show ADDRESS shows a recorded object; terraform show displays state or a saved plan. State inspection can reveal secrets.
• terraform state rm ADDRESS forgets the binding without deleting the remote object. If its configuration remains, a later plan may try to create another object. A reviewed removed block with destruction disabled provides a declarative alternative.
• Set TF_LOG to a diagnostic level such as DEBUG or TRACE when troubleshooting; TF_LOG_PATH writes logs to a file. Disable logging afterward and protect logs because provider requests may contain sensitive data. Inspect initialization, authentication, provider diagnostics and the exact address before changing state.

Choose under exam pressure

Traps

• Removing state is not resource cleanup.
• Import may succeed while the next plan still proposes destructive changes.

Practise this topic

Memory hook: Workspace owns a run; project groups the work.

Must remember

HCP Terraform adds a managed workflow around Terraform: shared state, run history, workspace variables, access controls and integrations. Execution can be remote, agent-based for private-network access, or local with supported state workflows. Terraform Enterprise is the self-managed product; Terraform Community supplies the CLI rather than the whole hosted collaboration system.

An HCP workspace represents a configuration, state, variables and run settings. It is not the same concept as a CLI workspace within one working directory. Projects group workspaces and help apply access and organizational controls. Variable sets share configuration across selected workspaces; carefully scope credentials and precedence.

VCS integration starts plans for proposed changes and runs after configured repository events. A speculative plan is a review preview, not an approved apply. CLI-driven and API-driven workflows support other automation models. An agent can execute runs where private infrastructure is reachable without exposing that infrastructure publicly.

Policy checks, run tasks, private modules, team permissions and cost estimation support governance; availability depends on the product edition and subscription. Policies evaluate rules; run tasks integrate external checks. Neither is a guarantee that an application is secure or its final bill matches an estimate.

Prefer workload identity/dynamic provider credentials over shared long-lived secrets where supported. Grant plan and apply permissions separately when reviewers should inspect changes without executing them.

Choose under exam pressure

Traps

• A CLI workspace and an HCP workspace are not interchangeable terms.
• Product governance features and pricing can change; exam concepts matter more than memorising plan names.

Practise this topic