Terraform Interview Questions

A JSON file mapping the resources in configuration to real infrastructure IDs and attributes. It's how Terraform knows what it manages, detects drift, and computes what a plan needs to change — without state, every apply would have no memory of what it created last time.

Local state is a single file on one machine — nobody else can safely run Terraform against the same infrastructure without it, and it's one lost laptop away from disaster. Remote state (S3, Terraform Cloud, etc.) gives a team a shared source of truth, supports locking so two applies can't race, and can be encrypted and access-controlled.

A lock Terraform acquires before any operation that could write to state, released when the operation finishes. It stops two concurrent applies from writing conflicting changes to the same state file. Without it, two engineers (or two CI runs) applying at once can corrupt state or apply against a stale plan.

plan computes and shows what would change to reconcile real infrastructure with configuration, without touching anything. apply does the same computation, then — after approval, or immediately with -auto-approve — actually makes those changes.

Both reconcile state with real infrastructure. refresh (legacy) writes the updated state immediately with no plan shown and no approval step. plan -refresh-only shows what a refresh would change first, and apply -refresh-only requires approval before writing — the safer, current way to do the same thing.

Re-initializes the backend from the configuration's backend block, discarding any previously cached backend settings, without attempting to migrate existing state into it. Use it when backend settings changed and you deliberately don't need the old state carried over.

Pull the current state with terraform state pull to inspect it, compare against the terraform.tfstate.backup Terraform writes before most state-modifying operations, and push the backup back if it's confirmed good with terraform state push. For anything less clear-cut, reconstruct from terraform import against real infrastructure rather than hand-editing the JSON.

Drift is when real infrastructure no longer matches what state says it should be — someone changed a resource outside Terraform (the console, another tool, a manual fix during an incident). terraform plan -refresh-only detects it without changing anything; a normal plan will also show it as part of the diff.

A resource block manages one real infrastructure object. A module is a reusable collection of resources (and often other modules) with its own input variables and outputs — the way Terraform configuration is composed and shared, analogous to a function versus a single statement.

Terraform is the provisioning engine; Terragrunt is a thin wrapper around it that manages DRY configuration across many environments — generating backend and provider blocks, wiring dependencies between modules, and running Terraform across a whole tree of environments with one command. Reach for it once you have enough environments that copy-pasted root modules become a real maintenance cost, not on day one.

Declarative configuration describes the desired end state; Terraform computes the diff and the safe order of operations to get there via its dependency graph. An imperative script would need to encode that ordering and idempotency itself — every run would have to re-derive "what already exists" and "what changed" by hand.