Terraform State Management

You are writing HCL to create three EC2 instances from a variable named `instance_names`, which is a list of strings. You want each instance's `Name` tag to match the corresponding string in the list. Which configuration correctly assigns the right name to each instance?

Your team must always deploy EC2 instances using the most recent official Ubuntu AMI, which changes frequently. You do not manage the AMI itself with Terraform, but you need its ID available in your configuration so the aws_instance resource can reference it. Which HCL construct should you use to obtain the AMI ID?

An engineer manages an AWS EC2 instance that runs a startup script needing an IAM policy to be fully attached before the instance boots. The instance configuration does not reference any attribute of the IAM policy resource, so Terraform sometimes creates them in parallel, causing the script to fail. Which change should the engineer make to guarantee correct ordering?

A team manages several S3 buckets using a single resource block. They currently use `count` with a list of bucket names in a variable. When they remove a name from the middle of the list and run `terraform plan`, Terraform proposes destroying and recreating multiple buckets that were not intended to change. Which change to the configuration best prevents this behavior while still iterating over the collection?

You are writing Terraform configuration that provisions an AWS EC2 instance which must be attached to a specific subnet. The subnet is created in the same configuration as an aws_subnet resource. You want Terraform to always create the subnet before the instance without adding any extra meta-arguments. What is the recommended way to achieve this ordering?

A developer adds a `local-exec` provisioner to an `aws_instance` resource to write the instance's public IP into a local inventory file after creation. During which point of the core Terraform workflow does this provisioner command execute by default?

Your team's Terraform configuration references the same complex expression — a combined name prefix built from the project name, environment, and region — in more than a dozen resource blocks. You want to define this value once so it can be reused throughout the configuration and updated in a single place, but it should NOT be settable from outside the module. Which construct should you use?

You are managing a deployment where a local script must re-run every time the application version changes. You use a null_resource with a local-exec provisioner that runs the deployment script. Currently, the provisioner only runs once on creation and never again, even when you update the app_version variable. Which change makes the provisioner re-execute whenever app_version changes?

You have provisioned an AWS EC2 instance in your root Terraform configuration. After running 'terraform apply', a teammate asks how they can quickly see the instance's public IP address on the command line without inspecting state or logging into the AWS console. What should you add to your configuration to surface this value automatically at the end of each apply?

You add an output block that references the private IP of an EC2 instance that will be created during the same apply. When you run 'terraform plan', the output value shows '(known after apply)' instead of an actual value. A teammate asks whether this indicates an error in your configuration. What is the correct explanation?

A teammate defines an output that exposes a database connection string containing a generated password. When they run `terraform apply`, the full connection string is printed in plain text at the end of the run, and it also appears in CI logs. They want the value to remain retrievable programmatically (for example via `terraform output -json` or by other configurations) but not be displayed in normal CLI output. What should they add to the output block?

You run `terraform plan` and see the following line in the output for one resource: `~ instance_type = "t2.micro" -> "t2.large"`. In the plan summary Terraform reports `Plan: 0 to add, 1 to change, 0 to destroy.` What does the `~` symbol indicate about how Terraform will carry out this change?

A DevOps engineer is writing a configuration to launch an EC2 instance and needs to install and start a web server when the instance boots. A teammate suggests using a remote-exec provisioner with an SSH connection block to run the installation commands. According to HashiCorp's guidance, what is the recommended approach in this situation?

A teammate wants to run a local shell script every time a specific EC2 instance is created by Terraform. They ask where the provisioner block that invokes this script must be placed so it executes as part of that instance's creation lifecycle. What is the correct guidance?

A team uses a remote-exec provisioner inside an aws_instance resource to run a bootstrap script after creation. During apply, the script exits with a non-zero status code. The team has not set any additional provisioner arguments. What does Terraform do by default when the provisioner fails?

A DevOps engineer must run a shell script on a newly created EC2 instance after Terraform provisions it. They have decided that user_data cannot be used for this task, so they add a remote-exec provisioner to the aws_instance resource. During apply, Terraform reports that it cannot establish a session to run the commands. What is the MOST likely cause of this failure?

You are configuring a remote-exec provisioner inside an aws_instance resource. Inside the provisioner's connection block, you need to reference the public IP address of the instance being created. Which expression correctly refers to that attribute?

You are writing a Terraform configuration and want to declare an input that lets operators optionally override the instance size, but defaults to "t3.micro" when no value is supplied. You add the following to variables.tf: variable "instance_type" { type = string default = "t3.micro" } During 'terraform plan', no value is passed for this variable on the command line, in a .tfvars file, or via an environment variable. What happens?

Your team wants to prevent an incorrectly formatted value from being supplied for an input variable named `instance_type`. You need Terraform to reject any value that does not start with the letter 't' and produce a clear error message during the plan phase, without relying on the provider to fail later. Which addition to the variable block accomplishes this?