Maintain Infrastructure with Terraform

Your team currently stores Terraform state in a file on a shared network drive that everyone edits from their laptops. You have experienced overwritten state files, lost updates, and exposed credentials stored in plaintext state. Leadership asks you to migrate to HCP Terraform as the remote backend. Which combination of benefits BEST justifies this migration compared to the current setup?

Your networking team manages VPC infrastructure in a separate Terraform configuration with its own state file stored in an S3 backend. The application team needs to reference the VPC ID and subnet IDs (exposed as outputs in the networking configuration) from their own separate configuration, without duplicating or hardcoding those values. What is the recommended approach?

Your team stores Terraform state in an S3 bucket configured as a remote backend. Two engineers run 'terraform apply' against the same configuration at nearly the same time. You want to guarantee that only one apply can modify the state at a time to prevent state corruption. Which addition to the S3 backend configuration accomplishes this?

Your team stores Terraform state in an S3 backend. A security review flags that the state file contains database passwords and TLS private keys in plaintext. Aside from restricting IAM access, which additional measure best protects this sensitive data at rest in the S3 backend?

Your team has been running Terraform with local state on a single engineer's laptop. To enable collaboration, you add an S3 backend configuration block to your Terraform files pointing to a new empty bucket. What is the correct next step to move the existing local state into the S3 backend?

Your team manages an RDS database with Terraform. A security audit flags that the database master password, passed via a variable marked `sensitive = true`, could still be exposed. Where is this password stored in plaintext, and what is the recommended mitigation?

A teammate's CI pipeline running 'terraform apply' against an S3 backend with DynamoDB locking crashed midway due to a network failure. Now every subsequent 'terraform plan' fails with an error indicating the state is locked, even though no operation is actually running. After confirming with the team that no apply is in progress, what is the recommended way to resolve this?

Your team uses an S3 backend without any locking mechanism configured. Two engineers run 'terraform apply' against the same state at nearly the same time. What is the primary risk this situation creates, and what feature is designed to prevent it?

Your team stores Terraform state in a plain HTTP backend that does not implement state locking. Several engineers run 'terraform apply' against the same configuration from their laptops throughout the day. What is the primary risk of this setup, and how should it be addressed?

A team originally deployed three S3 buckets using count, creating addresses like aws_s3_bucket.data[0], [1], and [2]. They refactored the configuration to use for_each with a map keyed by "logs", "backup", and "archive". Running terraform plan now shows Terraform wants to destroy the three indexed buckets and create three new keyed ones. Which action lets them adopt the new addressing without destroying and recreating the buckets?

Your team is splitting a large Terraform configuration into two separate root modules, each with its own remote backend state file. A resource named aws_db_instance.primary currently exists in the original state file but should now be managed by the new configuration without destroying and recreating the live database. Which approach correctly moves this resource between the two separate state files?

A teammate refactored a configuration by wrapping a single existing resource in a for_each block. The resource was previously declared as `aws_s3_bucket.logs` and is now addressed as `aws_s3_bucket.logs["prod"]`. Running `terraform plan` shows Terraform wants to destroy the old bucket and create a new one. Which command updates the state so the existing bucket is preserved and matched to its new address?

You are debugging an issue in a CI pipeline that uses an S3 remote backend. You need to retrieve the current state as raw JSON so you can pipe it into a script that extracts a resource's attribute values, without modifying the state in any way. Which Terraform command should you use?

A teammate provisioned an S3 bucket through Terraform, but ownership of that bucket is being transferred to another team who will manage it manually going forward. You need Terraform to stop tracking the bucket in your configuration's state, but the bucket itself must remain intact in AWS with no interruption. Which command accomplishes exactly this?

A teammate manually renamed an S3 bucket in the AWS console, breaking the mapping in your Terraform state. The next terraform plan proposes to destroy the old bucket (which no longer exists) and create a new one. You want to keep the current live bucket under Terraform management without destroying it, and without changing its resource address in the configuration. Which approach accomplishes this?

Your team manually deleted an S3 bucket through the AWS Console because it was created outside of Terraform's intended scope, but the bucket resource block still exists in your Terraform state. Running `terraform plan` now shows an error because the resource no longer exists in AWS. You have already removed the corresponding resource block from your configuration. Which command should you run to stop Terraform from tracking this already-deleted resource without attempting to destroy anything?

A DevOps engineer manually created an EC2 instance directly in the AWS console. It is not tracked by Terraform, but a colleague accidentally added a matching resource block and ran 'terraform apply', which created a SECOND duplicate instance that Terraform now tracks in state. The team wants Terraform to manage the ORIGINAL console-created instance and delete the accidental duplicate. What is the correct sequence of actions?

Your team refactored a Terraform configuration, renaming an existing resource block from `aws_db_instance.primary` to `aws_db_instance.production`. When you run `terraform plan`, Terraform proposes to destroy the old database and create a new one — an unacceptable outcome for a production RDS instance. Which command correctly updates the state so that the existing database is preserved and associated with the new resource address?

A colleague reports that a production RDS instance managed by Terraform appears to have an unexpected value for its allocated storage. Before making any changes, you want to inspect the full set of attributes—including the allocated storage—that Terraform currently has recorded for that specific resource in state, without querying the live AWS API. Which command should you run?