Terraform Interview Preparation: Questions, Answers & Tips for 2026

If you have a DevOps, cloud, or platform engineer interview coming up, there is a good chance someone will ask you about Terraform. It is one of the most popular tools for building cloud setups with code, and interviewers like to ask about it because your answers show how you think about real systems.

Here is the good news. Terraform interviews follow a pattern. Most questions come from about ten topics, and once you know them, nothing feels new. This guide walks through those topics with short answers you can say out loud, plus a study plan, common mistakes, and a quick FAQ.

What Interviewers Really Want to Hear

Almost nobody expects you to remember every command flag. What they want to know is simple:

• Do you understand state, and why it can break things?
• Can you work safely in a team, without stepping on other people?
• Do you know what to do when something goes wrong at 2 a.m.?

Keep these three points in your mind. When you answer, explain the “why” and not only the “what.” That single habit makes you sound like someone who has done the work.

The Terraform Workflow in One Picture

You will be asked about this flow in almost every interview, so practise saying it in your own words. You write code, run init, check the plan, and apply. Destroy is there when you no longer need the setup.

Beginner Terraform Interview Questions

1. What is Terraform?

Terraform is a tool that lets you create and manage servers, networks, databases, and other cloud parts by writing code. You describe what you want, and Terraform works out the steps to get there. It works with AWS, Azure, Google Cloud, Kubernetes, and hundreds of other services through plugins called providers.

2. What is Infrastructure as Code, and why use it?

It means you keep your setup in files instead of clicking around in a web console. The main gains are speed, fewer mistakes, and history. You can review changes in a pull request, roll back with Git, and build the same setup again in a new region in minutes.

3. What does terraform init do?

It gets your folder ready. It downloads the providers, sets up the backend where state is stored, and pulls in any modules you use. You must run it first, and again whenever you add a new provider or module.

4. What is the difference between terraform plan and terraform apply?

Plan is a preview. It compares your code with the current state and shows what will be added, changed, or removed, without touching anything. Apply makes those changes for real. In a team, a good habit is to save the plan to a file and apply that exact file, so nothing changes between review and release.

5. What is a provider?

A provider is a plugin that talks to one platform, such as AWS or Azure. Without it, Terraform does not know how to create anything there.

6. What is the difference between a resource and a data source?

A resource is something Terraform creates and manages. A data source only reads information that already exists, like the latest AMI ID or an existing VPC. Data sources never create or delete anything.

7. What are variables, locals, and outputs?

• Variables are inputs. They let you reuse the same code with different values.
• Locals are names for values you use often inside one module, so you do not repeat yourself.
• Outputs send values out, for example a load balancer address, so people or other modules can use them.

Commands You Should Know by Heart

Command	What it does
terraform init	Sets up providers, modules, and backend
terraform fmt	Fixes code style and spacing
terraform validate	Checks that the code is written correctly
terraform plan	Shows what would change
terraform apply	Makes the changes
terraform destroy	Removes everything in the state
terraform state list	Lists what Terraform is tracking
terraform import	Brings an existing resource under Terraform control
terraform output	Shows output values

Intermediate Terraform Interview Questions

8. What is the state file, and why does it matter?

The state file is Terraform’s memory. It records which real-world items belong to your code. Without it, Terraform would not know if a server already exists or needs to be built. It can also hold sensitive data in plain text, so treat it like a password file. Never commit it to Git.

9. Why use remote state and state locking?

If state lives on your laptop, your teammates cannot see it and you can lose it. Remote state, for example in an S3 bucket, gives the whole team one shared copy. Locking makes sure only one person or pipeline can change things at a time. Without a lock, two applies can run together and damage the state.

10. What is a module?

A module is a folder of Terraform code that you can reuse, like a small recipe. Instead of writing the same network setup five times, you write it once as a module and call it with different inputs. Good answers also mention that modules should be small, have clear inputs and outputs, and use version numbers.

11. What is the difference between count and for_each?

	count	for_each
Works with	A number	A map or a set of strings
Item identity	By position (0, 1, 2)	By key (like “web” or “db”)
Risk	Removing an item from the middle shifts the rest and may destroy things	Safe to add or remove single items
Best for	Simple on/off switches, or exact copies	Groups of things with different names

If the interviewer asks which one you prefer, say for_each in most cases. The position problem with count is a real cause of surprise deletions.

12. What are workspaces?

Workspaces let one set of code keep several separate state files, for example dev and test. Many teams, however, prefer separate folders or separate pipelines for each environment because it is easier to see what is deployed where. It is fine to say that. It shows you have thought about it.

13. What does the lifecycle block do?

It changes how Terraform treats a resource. The three settings you should know are create_before_destroy (build the new one first, then remove the old one), prevent_destroy (block accidental deletion, good for databases), and ignore_changes (skip changes made outside Terraform, such as tags added by another tool).

14. Are provisioners a good idea?

Usually not. Provisioners run scripts on a server after it is created, but they are hard to test and Terraform cannot track what they do. HashiCorp itself calls them a last resort. Better options are user data, cloud-init, prebuilt images, or a tool like Ansible.

Advanced and Scenario-Based Questions

This is where interviews are won. The interviewer describes a problem and watches how you think. Speak in steps, and say what you would check first.

15. A teammate changed a resource by hand in the console. What happens?

This is called drift. When you run plan, Terraform compares the real setup with the state and shows the difference. You then choose: apply to put things back the way the code says, or update the code to match the manual change. Then talk about prevention: limit console access, and run a scheduled plan to catch drift early.

16. Your pipeline failed and the state is locked. What do you do?

First, check that no other run is still working. Most locks are left behind by a crashed job. Only after you are sure nothing is running, use terraform force-unlock with the lock ID. Say clearly that you would never unlock blindly, because that can corrupt the state.

17. How do you handle secrets?

• Do not hard-code passwords in .tf files or in variable files that go to Git.
• Pull secrets from a vault or secret manager at run time.
• Mark variables and outputs as sensitive so they do not print in logs.
• Remember that sensitive values can still end up in the state file, so lock down access to state.

Recent Terraform versions also add ephemeral values, which are not saved to state. Mentioning this shows you keep up with changes.

18. How do you bring an existing resource under Terraform?

Write the resource block, then import it. Newer versions support an import block, which is nicer because it shows up in plan and can be reviewed like normal code:

import {

  to = aws_s3_bucket.logs

  id = “my-company-logs”

}

19. You renamed a resource in code. How do you stop Terraform from destroying it?

Use a moved block. It tells Terraform that the old address and the new address are the same thing, so it updates the state instead of deleting and rebuilding.

moved {

  from = aws_instance.web

  to   = aws_instance.app

}

20. How would you set up Terraform for dev, staging, and production?

A safe setup has one shared set of modules and a separate folder (or pipeline) for each environment, each with its own remote state. Production gets extra care: manual approval before apply, tighter access, and pinned versions. Small differences between environments should live in variable files, not in copied code.

21. How does Terraform fit into CI/CD?

A common flow: a pull request triggers fmt, validate, and plan. The plan is posted as a comment for review. After approval and merge, the pipeline applies the saved plan. Add a policy check or a security scanner before apply if you can.

22. What is the difference between Terraform and OpenTofu?

In 2023 HashiCorp moved Terraform to the Business Source License. In response, the community started OpenTofu, an open-source fork run by the Linux Foundation. HashiCorp is now part of IBM. For most everyday work the two feel almost the same, but they are slowly growing apart. A calm, balanced answer works best: you know both exist, and you would follow your company’s choice.

What Is New in 2026 That Is Worth Knowing

• Import blocks for reviewable imports, as shown above.
• Moved and removed blocks for safe refactoring.
• terraform test, a built-in way to write tests for your modules.
• Ephemeral values to keep secrets out of state.
• HCP Terraform, the new name for Terraform Cloud, which offers remote runs, state storage, and policy checks.
• OpenTofu as a real option in many companies.

8 Practical Tips to Perform Better

1. Build something small before the interview. A VPC, a server, and a load balancer is enough. Hands-on memory beats reading.
2. Use the STAR method for experience questions. Say the situation, your task, what you did, and the result.
3. Say “I would check” when you are unsure. It sounds honest and shows a safe way of working.
4. Learn state well. Most hard questions come back to state.
5. Be ready to read code. Many interviewers paste a snippet and ask what is wrong.
6. Know one cloud deeply. AWS, Azure, or GCP. Do not pretend to know all three.
7. Have one story about a mistake. A time something broke and what you learned is very believable.
8. Talk about security early. Mention least access, encrypted state, and no secrets in code.

Common Mistakes That Cost Candidates the Job

• Mixing up plan and apply or forgetting that plan changes nothing.
• Saying state can be stored in Git. It should not be.
• Using count for everything, then being unable to explain what happens when the list changes.
• Never mentioning testing, reviews, or approvals.

A 14-Day Study Plan

Days	Focus	What to do
1–2	Basics and workflow	Install Terraform. Run init, plan, apply, and destroy on a small setup.
3–4	Variables, outputs, data sources	Rewrite your setup so nothing is hard-coded.
5–6	State and remote backend	Move state to S3 (or your cloud’s option) with locking.
7–8	Modules	Turn your network code into a reusable module.
9–10	count, for_each, lifecycle	Create several servers both ways and see what changes.
11	Import, moved, drift	Create a resource by hand, import it, then rename it safely.
12	CI/CD and secrets	Run plan on a pull request. Pull one secret from a vault.
13	Mock interview	Answer the questions in this guide out loud, with a timer.
14	Review and rest	Go over weak spots. Sleep well.

Frequently Asked Questions

Final Words

Good Terraform interview prep comes down to three things: understand state, practise with real code, and explain your thinking in plain words. You do not have to know everything. You have to show that you can work carefully and learn quickly.

Similar Article