Master Collection

What is Infrastructure as Code (IaC) and what core problems does it solve?

Infrastructure as Code (IaC) is the practice of provisioning, configuring, managing, and versioning compute, storage, and networking resources using machine-readable definition files rather than manual console clicks. It eliminates human configuration errors, eradicates "Snowflake Servers," enforces version control, and allows tearing down and recreating entire production environments in minutes.

Compare Declarative vs Imperative IaC with concrete examples.

• Declarative (e.g., Terraform, OpenTofu, Kubernetes YAML): Declares WHAT the eventual infrastructure state should be. The engine computes dependencies and executes CRUD operations to match that state (resource "aws_s3_bucket" "b" { ... }).
• Imperative (e.g., AWS CLI, Bash scripts, Python Boto3): Specifies HOW to reach the state via sequential commands (aws s3api create-bucket ...). Re-running imperative scripts fails without explicit custom idempotency logic.

What is Terraform State and why is it necessary?

The Terraform state file (terraform.tfstate) is a JSON document that maps your declarative HCL configuration to real-world cloud resource IDs and attributes. It tracks resource dependencies, caches metadata for plan performance, and coordinates concurrent execution via state locking.

Explain the core Terraform CLI workflow commands.

1. terraform init: Initializes working directory, downloads provider plugins/modules, and configures remote backends.
2. terraform validate: Validates syntax and internal consistency of HCL files without cloud API calls.
3. terraform plan: Computes the execution plan by comparing code against state and live infrastructure.
4. terraform apply: Executes the changes required to reach desired state.
5. terraform destroy: Destroys all remote objects managed by the state file.

Compare Terraform count vs for_each.

• count: Creates resources indexed by an integer list ([0, 1, 2]). Removing an item from the middle causes Terraform to reindex and force-recreate all subsequent resources.
• for_each: Creates resources keyed by unique map or set strings (["web", "api", "db"]). Adding or removing an item affects only that specific key without destroying others.

What is a Terraform Module and how does it enforce DRY principles?

A container for multiple resources used together. Modules package reusable, standardized infrastructure components (VPCs, EKS clusters) with input variables and outputs, avoiding code duplication across environments.

Compare Terraform Variables, Locals, and Outputs.

• Variables (variable): Input parameters passed into modules to customize behavior.
• Locals (locals): Internal reusable constants or computed expressions scoped strictly to the current module.
• Outputs (output): Return values exposed by a module to the root module or CLI stdout.

What is a Remote Backend and why is State Locking mandatory?

A remote storage location (e.g., AWS S3 + DynamoDB / Terraform Cloud) for state files. State locking prevents race conditions and corrupted state files by ensuring only one engineer or pipeline can execute apply at any time.

What is OpenTofu and why was it created?

In August 2023, HashiCorp switched Terraform's license from open-source MPL 2.0 to the Business Source License (BSL 1.1). OpenTofu was created by the Linux Foundation and community as a 100% open-source, backward-compatible fork of Terraform.

What is Configuration Drift in IaC and how is it resolved?

Discrepancies between declared IaC code and actual live cloud resources caused by manual console edits. Resolved by running automated scheduled drift detection (terraform plan -detailed-exitcode) and applying code to reconcile drift.

What is the moved block in Terraform?

Allows refactoring resources (renaming or moving into child modules) without destroying and recreating live cloud resources:

moved {
  from = aws_instance.web
  to   = module.compute.aws_instance.web
}

What is the import {} block in Terraform 1.5+?

A declarative block that imports existing cloud resources into Terraform state natively in code, generating configuration templates automatically via terraform plan -generate-config-out=generated.tf.

What are Terraform Custom Preconditions and Postconditions?

Declarative validation rules defined inside lifecycle blocks that validate assertions before or after resource provisioning:

lifecycle {
  precondition {
    condition     = data.aws_ami.ubuntu.architecture == "x86_64"
    error_message = "Selected AMI must be x86_64."
  }
}

What is Terragrunt and what problems does it solve?

A thin wrapper for Terraform/OpenTofu providing DRY remote state backend definitions, automated module dependency execution (terragrunt run-all apply), and mock outputs for plan evaluations.

What are Terraform Dynamic Blocks?

Constructs repeatable nested configuration blocks (e.g., multiple ingress rules inside an aws_security_group) dynamically from a list or map variable.

Compare .terraform.lock.hcl vs terraform.tfstate.

• .terraform.lock.hcl: Dependency lock file recording exact provider plugin versions and cryptographic hashes; committed to Git.
• terraform.tfstate: Records live cloud resource IDs and attributes; stored in an encrypted remote backend, never committed to Git.

How do you protect sensitive values in Terraform?

Mark variables/outputs with sensitive = true to prevent display in CLI stdout or CI logs. Caveat: State files still contain plain text sensitive values and must be stored in KMS-encrypted S3 backends with restricted IAM.

What is Terratest?

A Go library developed by Gruntwork that provisions real cloud infrastructure via Terraform, executes integration tests against live endpoints, and tears down resources.

What is Crossplane?

A CNCF open-source project that turns Kubernetes into a universal cloud control plane, allowing platform teams to manage cloud resources (S3, RDS) as Kubernetes Custom Resources (CRDs).

What is Pulumi?

An open-source IaC engine that allows defining cloud infrastructure using general-purpose programming languages (TypeScript, Python, Go, C#) with full IDE auto-complete and unit test support.

What is Ansible and how does its agentless architecture work?

An open-source automation and configuration management tool that connects to target nodes over standard SSH (Linux) or WinRM (Windows) without installing daemons or agents on managed nodes.

What is Ansible Idempotency?

The property of an Ansible playbook where executing it once or multiple times produces the exact same end state without unintended side effects.

Compare Terraform vs Ansible.

Terraform is optimized for infrastructure provisioning (orchestrating VPCs, EKS, RDS) using declarative state; Ansible is optimized for configuration management (installing packages, configuring OS files) on running servers.

What is terraform refresh?

Queries cloud APIs to update the local state file with real-world resource attributes without modifying live infrastructure.

What is a Terraform Data Source?

A read-only query that fetches attributes from external cloud resources defined outside the current configuration (e.g., querying the latest official Ubuntu AMI ID).

What is terraform taint vs terraform apply -replace?

terraform taint is legacy; terraform apply -replace="aws_instance.web" forces recreation of a specific resource in a single step without modifying state beforehand.

What are Terraform Workspaces?

Separate state files managed from a single working directory (terraform workspace select staging). Best for ephemeral feature branches; directory-based layouts are preferred for production isolation.

What is terraform fmt?

Automatically rewrites all .tf files in the directory to conform to canonical Terraform style and indentation standards.

What is terraform graph?

Generates a visual Directed Acyclic Graph (DAG) of all resource dependencies in DOT format for graphviz visualization.

What is Checkov?

A static code analysis tool scanning Terraform, CloudFormation, and Kubernetes manifests in CI pipelines for security misconfigurations and compliance violations.

What is tfsec / Trivy for IaC?

Fast static security scanners that parse HCL code and flag security risks (unencrypted storage, public S3 buckets, open security groups) before deployment.

What is Infracost?

A CLI tool that parses Terraform code in CI/CD pull requests, calculates the exact monthly cost delta of proposed infrastructure changes, and posts an interactive breakdown comment onto the PR.

What is Atlantis for Terraform?

A self-hosted application that executes terraform plan on PR creation, posts the diff, locks state, and applies changes only when authorized reviewers comment atlantis apply.

What is HashiCorp Cloud Platform (HCP) Terraform / Terraform Cloud?

A managed collaborative platform providing remote execution runners, centralized state locking, private module registries, cost estimation, and Sentinel policy enforcement.

What is Spacelift?

A collaborative infrastructure orchestration platform for Terraform, OpenTofu, Pulumi, and CloudFormation with built-in OPA policy enforcement and drift detection.

What is the ignore_changes lifecycle rule in Terraform?

Instructs Terraform to ignore updates to specific resource attributes caused by external systems or autoscaling (e.g., lifecycle { ignore_changes = [tags, desired_capacity] }).

What is create_before_destroy lifecycle rule?

Inverts Terraform's default replacement behavior by creating the replacement resource first before destroying the old resource, minimizing service downtime.

What is prevent_destroy lifecycle rule?

Causes Terraform to reject any execution plan that would destroy the annotated critical resource (e.g., production database).

What is a Terraform Provider Alias?

Allows configuring multiple instances of the same provider (e.g., deploying resources across multiple AWS regions or accounts in a single configuration) using alias = "west".

What is Terraform Variable Precedence?

Evaluated with increasing priority: Environment variables (TF_VAR_name) $\rightarrow$ terraform.tfvars $\rightarrow$ terraform.tfvars.json $\rightarrow$ *.auto.tfvars $\rightarrow$ CLI flags (-var).

What is terraform state rm vs terraform state mv?

• state rm: Removes a resource from state; live cloud resource is not deleted, Terraform simply stops managing it.
• state mv: Renames or moves a resource within state without destroying or recreating it.

What is Terraform Provider Mirroring?

Configuring CLI config (.terraformrc) to read pre-downloaded provider binaries from local disk or private registries in air-gapped environments without internet access.

What is Terraform Blast Radius and how do you minimize it?

The maximum potential damage from a failed apply. Minimized by breaking monolithic state files into layered, decoupled state files (Networking $\rightarrow$ Data $\rightarrow$ Compute $\rightarrow$ App).

What is Ansible Playbook vs Role vs Collection?

• Playbook: YAML file mapping tasks and configuration states to target hosts.
• Role: Reusable directory packaging tasks, handlers, variables, and templates.
• Collection: Modern packaging format containing multiple roles, custom Python modules, and plugins.

What is Ansible Inventory (Static vs Dynamic)?

• Static: INI/YAML file listing static hostnames and IP addresses.
• Dynamic: Plugin querying cloud APIs (AWS EC2, Azure) to dynamically discover target instances based on tags.

What is Ansible Vault?

Encrypts sensitive variables, files, or playbooks with AES-256 (ansible-vault encrypt secrets.yml).

What is OpenTofu State Encryption?

A native OpenTofu feature allowing state files and plan files to be encrypted end-to-end at the client level using AES-GCM or AWS KMS before being transmitted to remote backends.

What is Terraform Plugin Framework (v6)?

Modern Go SDK for authoring Terraform providers with native support for structured types, nested object attributes, and gRPC protocol buffers.

What is Crossplane Composite Resource (XR) vs Claim (XRC)?

• XRD: Platform team defines the abstract schema (kind: DatabaseInstance).
• Composition: Binds XRD to concrete cloud resources (RDS, Security Group, KMS Key).
• Claim: Developers request a database via a simple 5-line Kubernetes manifest without knowing AWS details.

What is HashiCorp Sentinel?

A proprietary Policy as Code framework embedded in Terraform Cloud that enforces compliance rules (e.g., blocking non-whitelisted EC2 instance types) before apply.

What is Open Policy Agent (OPA) / Conftest for Terraform?

Evaluates exported Terraform execution plans in JSON format against declarative Rego security policies in CI pipelines.

What is KubeVela?

A modern application delivery platform on Kubernetes built on the Open Application Model (OAM) providing application-level abstractions over underlying infrastructure.

What is Terraform terraform_remote_state Data Source?

A data source that reads root output values from a separate remote state file, enabling loose coupling between infrastructure layers.

What is Terraform templatefile() function?

Renders an external template file with dynamic variable interpolation (e.g., rendering user_data.sh scripts).

What is Terraform null_resource vs terraform_data?

• null_resource (Legacy): Requires downloading a separate provider plugin to execute local scripts (local-exec).
• terraform_data (Built-in since 1.4): Native replacement for null_resource requiring zero external provider downloads.

What is local-exec vs remote-exec Provisioner?

• local-exec: Runs a local command on the machine executing Terraform.
• remote-exec: Connects to the provisioned remote instance over SSH/WinRM to execute shell commands. Best practice: Avoid provisioners; use cloud-init or Ansible.

What is Terraform Provider Dependency Lock?

Records exact cryptographic provider checksums in .terraform.lock.hcl to ensure all team members and CI runners download identical provider binaries.

What is Terraform Self Reference (self)?

An object referring to the resource's own attributes within provisioner or connection blocks.

What is Terraform Module Registry?

A public or private repository for discovering and distributing versioned, reusable Terraform modules.

What is terraform force-unlock?

Releases a stuck remote state lock in DynamoDB/Consul when a previous run crashed unexpectedly: terraform force-unlock <LOCK-ID>.

Explain the step-by-step lifecycle of terraform plan.

1. Loads configuration files and builds the Dependency Graph (DAG).
2. Reads the current state file from the remote backend.
3. Refreshes state: Queries cloud APIs to fetch current live resource attributes.
4. Compares live state against declared code to determine CRUD deltas (Add, Change, Destroy).
5. Outputs the execution plan diff.

What is Terraform Graph Cycle and how is it resolved?

A circular dependency error where Resource A depends on Resource B, and Resource B depends on Resource A. Resolved by decomposing circular references (e.g., creating security groups first, defining aws_security_group_rule as independent resources).

How do you implement Zero-Downtime AMI updates in Auto Scaling Groups using Terraform?

1. Use aws_launch_template with create_before_destroy = true.
2. Configure instance_refresh block in aws_autoscaling_group to orchestrate rolling instance replacements automatically upon template updates.

What is the difference between lookup(), try(), and can() functions in HCL?

• lookup(map, key, default): Retrieves value from a map with a fallback default.
• try(expr1, expr2, ...): Evaluates expressions sequentially, returning the first one that does not produce an error.
• can(expr): Evaluates an expression and returns true if it succeeds without errors, or false otherwise.

What is OpenTofu Early Evaluation of Variables?

An OpenTofu feature allowing variables and locals to be evaluated during backend configuration blocks, eliminating hardcoded backend S3 bucket names.

What is Terragrunt read_terragrunt_config()?

Imports helper HCL files into a Terragrunt configuration, allowing centralized sharing of environment variables, AWS account IDs, and common tags.

What is Terragrunt dependency Block?

Declares a dependency on another module, automatically resolving remote outputs and establishing execution order (terragrunt run-all apply).

What are Terragrunt mock_outputs?

Supplies mock return values during terragrunt plan when an upstream dependency module has not yet been applied, preventing plan failures.

How do you implement automated Terraform Drift Detection in CI/CD?

A scheduled cron pipeline executing:

terraform plan -detailed-exitcode -no-color

• Exit 0: Succeeded, no differences.
• Exit 1: Malformed configuration or API error.
• Exit 2: Succeeded with non-empty diff (Drift Detected $\rightarrow$ alerts Slack).

How do you test Terraform modules with Terratest in Go?

func TestVpcModule(t *testing.T) {
    terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
        TerraformDir: "../modules/vpc",
        Vars: map[string]interface{}{"cidr_block": "10.0.0.0/16"},
    })
    defer terraform.Destroy(t, terraformOptions)
    terraform.InitAndApply(t, terraformOptions)
    vpcId := terraform.Output(t, terraformOptions, "vpc_id")
    assert.NotEmpty(t, vpcId)
}

What is Policy as Code with Rego and Conftest?

Export plan to JSON (terraform show -json tfplan.binary > tfplan.json), then evaluate against Rego rules in CI:

package main
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    not resource.change.after.server_side_encryption_configuration
    msg := "S3 buckets must have server-side encryption enabled!"
}

What is OpenTofu Provider Plugin Signing and Verification?

OpenTofu verifies cryptographic PGP signatures and SHA256 checksums of all downloaded provider binaries against registry public keys before loading them into memory.

What is Terraform Module Semantic Versioning?

Pinning module sources to specific SemVer versions (source = "terraform-aws-modules/vpc/aws?version=5.1.0") to prevent untested breaking changes from being applied automatically.

What is the difference between merge() and concat() in HCL?

• merge(map1, map2): Combines two or more maps into a single map (keys overwritten by rightmost map).
• concat(list1, list2): Combines two or more lists into a single sequential list.

What is Terraform Custom Provider development?

Authoring custom Go plugins using the HashiCorp Terraform Plugin Framework that implement Create, Read, Update, and Delete methods against internal proprietary APIs.

Scenario: An engineer accidentally ran terraform destroy against staging and cancelled it midway. How do you recover?

1. Release any stuck state locks: terraform force-unlock <LOCK-ID>.
2. Sync state: terraform refresh.
3. Generate targeted recovery plan: terraform plan -out=recovery.plan.
4. Apply plan to recreate destroyed resources and restore consistency: terraform apply recovery.plan.

Scenario: Refactor a monolithic 500-resource Terraform state into 5 decoupled state files with zero downtime.

1. Backup production state file.
2. Create target directory structure (01-network/, 02-database/, 03-compute/).
3. Migrate resources using terraform state mv -state=monolith.tfstate -state-out=02-database/terraform.tfstate <source> <dest>.
4. Initialize remote S3 backends in each new directory.
5. Verify with terraform plan in each directory to confirm 0 to add, 0 to change, 0 to destroy.

Scenario: A live production AWS S3 bucket containing 50TB of data was created manually. Bring it under Terraform management with zero data loss risk.

1. Declare resource in HCL: resource "aws_s3_bucket" "prod_data" { bucket = "company-prod-data" }.
2. Import resource via import {} block (Terraform 1.5+).
3. Run terraform plan and reconcile attributes until plan shows 0 to add, 0 to change, 0 to destroy.
4. Apply to bind state.

Compare Crossplane vs Terraform at enterprise scale.

• Terraform: Pipeline-driven batch execution; drift detected only on pipeline runs.
• Crossplane: Continuous control plane loop inside Kubernetes; continuously auto-heals drift and provides native Kubernetes CRD abstractions for developers.

How do you structure a production multi-environment Terragrunt repository?

root/
├── terragrunt.hcl               # Root config: S3 backend + provider generation
├── environments/
│   ├── dev/
│   │   ├── vpc/terragrunt.hcl
│   │   └── eks/terragrunt.hcl   # dependencies = ["../vpc"]
│   ├── staging/
│   └── prod/
└── modules/                     # Pure Terraform source modules

How do you implement zero-trust secrets injection in Terraform without writing credentials to disk?

Configure Terraform with the HashiCorp Vault Dynamic Secrets Provider (data "vault_aws_access_credentials"). Terraform requests short-lived (1-hour) cloud credentials generated on-demand by Vault, eliminating static keys entirely.

Scenario: An engineer accidentally committed a production .tfstate file containing database passwords to GitHub. Walk through the complete response procedure.

1. Rotate All Secrets Immediately: Rotate database master passwords, private TLS keys, and IAM credentials in the cloud provider.
2. Purge Git History: Use git-filter-repo to permanently strip .tfstate from all commits, branches, and tags. Force-push clean history.
3. Move to Remote S3 Backend: Configure remote encrypted S3 backend with DynamoDB locking.
4. Enforce Prevention: Add *.tfstate to .gitignore and configure GitHub Secret Scanning.

What is Ansible Dynamic Inventory for AWS EC2?

An Ansible plugin (aws_ec2) that queries AWS APIs to automatically group managed instances based on tags (e.g., tag:Role_webservers), eliminating static IP files.

What is Pulumi Stack?

An isolated, independently configurable instance of a Pulumi program (e.g., dev, staging, prod) with its own state and secrets encryption provider.

What is Pulumi Crosswalk?

A collection of high-level libraries (in TypeScript/Python) that implement well-architected cloud infrastructure best practices (e.g., creating a production VPC in 5 lines of code).

What is Crossplane Provider Family?

Modular, decoupled Crossplane provider packages (e.g., provider-aws-s3, provider-aws-rds) that install only the specific CRD controllers needed, avoiding cluster CRD limits.

What is Crossplane Composition Function?

Advanced gRPC functions (written in Go, Python, or KCL) that dynamically render complex compositions and conditionals that static YAML cannot express.

What is Terraform Provider Factory in Unit Tests?

Mocking cloud provider responses during unit tests to validate HCL logic and module transformations without making real cloud API calls.

What is Terraform replace_triggered_by?

A lifecycle attribute that forces a resource to be replaced whenever another specified resource changes (e.g., replacing an EC2 instance whenever a security group changes).

What is OpenTofu Client-Side State Encryption Key Rotation?

Rotating state encryption keys by declaring the new key in the OpenTofu configuration and running tofu apply, which re-encrypts the state file transparently.

What is Ansible Asynchronous Actions (async and poll)?

Running long-running tasks (e.g., database backups) asynchronously in the background while polling for status periodically.

What is Ansible Handler?

A special task executed only when notified by another task that resulted in a changed status (e.g., restarting Nginx only when nginx.conf changes).

What is Ansible Serial Execution (serial)?

Rolling execution of playbooks across batches of servers (e.g., serial: "20%") to perform zero-downtime rolling updates.

What is Ansible Tower / AWX?

A web-based UI, REST API, and task engine for centrally managing Ansible playbooks, inventories, credentials, and RBAC across enterprise teams.

What is Terraform nonsensitive() function?

Exposes a sensitive value as non-sensitive when strictly required for display or passing to external non-sensitive modules.

What is Terraform Output depends_on?

Explicitly ordering output evaluation after specified resources complete provisioning.

What is Terraform Module Nesting Best Practice?

Keep module nesting to a maximum of 2 levels (Root $\rightarrow$ Child Module). Excessive nesting creates brittle dependency graphs and unmaintainable code.

What is Terraform CLI Configuration (.terraformrc)?

A configuration file on the developer workstation or CI runner managing plugin cache directories, credentials helpers, and provider installation mirrors.

What is Terraform Plugin Cache Directory (TF_PLUGIN_CACHE_DIR)?

Caching downloaded provider binaries locally on disk across multiple directories, saving gigabytes of bandwidth and minutes of CI build time.

What is Policy as Code Shift-Left Testing?

Executing OPA/Checkov linters directly in pre-commit hooks and PR builds to catch compliance violations before code is merged to main.

What is Terraform JSON Syntax (*.tf.json)?

Allowing Terraform configurations to be written in standard JSON rather than HCL, useful for machine-generated infrastructure templates.

What is Pulumi Automation API?

An SDK that embeds Pulumi infrastructure provisioning directly inside application code (e.g., a SaaS app provisioning tenant databases programmatically in Go).

What is Crossplane Environment Config?

Injecting shared global configuration variables (AWS Account IDs, environment names) dynamically into Crossplane Compositions.

What is Ansible Fact Gathering (setup module)?

Automatically discovering hardware, OS, network, and disk facts from target hosts upon playbook execution and storing them in ansible_facts.

What is Terraform terraform_version Constraint?

Locking configurations to compatible engine versions (required_version = ">= 1.5.0, < 2.0.0") to prevent syntax incompatibility issues.

What is Terraform Provider Source Address?

The fully qualified global namespace of a provider: registry.terraform.io/hashicorp/aws.

What is OpenTofu Registry?

An open-source, community-operated public registry (get.opentofu.org) hosting verified providers and modules for OpenTofu.

What is Terragrunt Run-All?

Recursively executes Terraform commands across all subdirectories in DAG dependency order (terragrunt run-all plan).

What is Terraform Remote State Locking Mechanism in DynamoDB?

Uses an MD5 hash of the state file and a unique lock ID written to a DynamoDB table with strong consistency to prevent concurrent applies.

What is Infracost FinOps Shift-Left?

Posting automated cloud cost delta comments on GitHub Pull Requests to make developers financially aware before merging infrastructure changes.

What is Trivy IaC Scanning?

Scanning Terraform, CloudFormation, and Dockerfile code for over 1,000 built-in security misconfiguration checks.

What is Checkov Custom Rego Policies?

Writing custom organizational compliance rules in Rego that Checkov evaluates against Terraform AST structures in CI.

What is Ansible Galaxy?

The public community repository for discovering, downloading, and sharing Ansible roles and collections.

What is Pulumi Secrets Provider?

Encrypting sensitive configuration values at rest in state using cloud KMS (AWS KMS, Azure Key Vault, HashiCorp Vault).

What is Crossplane Package Manager?

Distributing and installing Providers and Configurations as OCI artifacts packaged and versioned in standard container registries.

What is Terraform State Inspect (terraform state show)?

Prints the exact attributes and current live state of a single specific resource managed by Terraform.

What is Terraform State List (terraform state list)?

Lists all resource addresses currently tracked in the state file.

What is Terraform Plan Output File (-out=tfplan)?

Saves the computed plan binary to disk, guaranteeing that terraform apply tfplan executes the exact evaluated diff without re-querying cloud APIs.

What is Terraform Variable Validation (validation block)?

Enforcing custom regex and logic rules on input variables before execution:

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

What is Terraform Sensitive Variable in Output?

Output values derived from sensitive variables are automatically marked sensitive and suppressed from CLI output.

What is Terraform Dynamic Provider Credentials?

Exchanging OIDC tokens from CI systems (GitHub Actions) for temporary cloud provider credentials dynamically during terraform apply.

What is Terraform State Pull (terraform state pull)?

Downloads and outputs the raw JSON state file from the remote backend to stdout.

What is Terraform State Push (terraform state push)?

Manually uploads a modified state file to the remote backend (used for state disaster recovery).

What is Terraform Enterprise Private Module Registry?

An internal organization module registry with built-in versioning, documentation generation, and access control.

What is Terragrunt Scaffold?

A CLI command that automatically generates boilerplate Terragrunt configuration files from a source Terraform module.

What is OpenTofu State Migration?

OpenTofu natively reads and writes existing Terraform state files with 100% backward compatibility.

What is Ansible Jinja2 Templating?

Dynamically generating configuration files (template module) with variable substitution and loops using Jinja2 syntax.

What is Ansible Block and Rescue?

Exception handling in playbooks: tasks in block are executed; if any fail, tasks in rescue execute to remediate.

What is Ansible Check Mode (--check)?

Dry-run execution that reports what changes would be made without actually modifying managed target servers.

What is Pulumi Policy as Code (CrossGuard)?

Enforcing organizational compliance rules across Pulumi stacks written in TypeScript or Python before resources are provisioned.

What is Crossplane Provider AWS vs Upjet AWS?

Upjet generates Crossplane providers automatically from Terraform provider schemas, ensuring 100% cloud resource coverage.

What is Terraform Cloud Agent?

Self-hosted worker processes deployed in private VPCs to execute Terraform Cloud runs against internal private resources.

What is Terraform Variable Definition File (terraform.tfvars)?

A file automatically loaded by Terraform containing key-value assignments for declared input variables.

What is Terraform Workspace Isolation Anti-Pattern?

Using workspaces for staging and production when environments require different AWS accounts, IAM roles, or backend configurations.

What is Terraform State File Locking Timeout (-lock-timeout)?

Instructs Terraform to wait up to $N$ duration (e.g., -lock-timeout=5m) to acquire a state lock before failing.

What is Terraform Output Value Interpolation?

Referencing child module outputs in parent modules using module.<name>.<output_name>.

What is Terraform Implicit Dependency?

Dependencies established automatically when one resource references an attribute of another resource (vpc_id = aws_vpc.main.id).

What is Terraform Explicit Dependency (depends_on)?

Manually declaring dependency order when no direct attribute reference exists in HCL code.

What is Terraform Provider Alias in Child Modules?

Passing custom provider configurations into child modules via the providers map block.

What is OpenTofu Early Backend Evaluation?

Evaluating variables and functions inside backend configuration blocks natively in OpenTofu.

What is Ansible Delegate_To?

Executing a specific task on a different host (e.g., taking an instance out of a load balancer on the control node) during a host playbook.

What is Ansible Local_Action?

Shorthand syntax for delegating a task to execute locally on the Ansible control machine.

What is Pulumi Resource Transformation?

Intercepting and programmatically modifying resource arguments across all resources in a Pulumi stack (e.g., auto-tagging all resources).

What is Crossplane Connection Secret?

Writing database passwords and endpoint URLs generated by cloud providers directly into Kubernetes Secret objects for application consumption.

What is Terraform S3 Backend Key Naming Convention?

Storing state files in structured S3 paths: env://prod/network/terraform.tfstate.

What is Terraform Backend Re-initialization (terraform init -reconfigure)?

Reconfiguring remote backend settings from scratch, disregarding any existing backend configuration cached in .terraform/.

What is Terraform Backend Migration (terraform init -migrate-state)?

Migrating state data automatically from one backend type to another (e.g., local state to remote S3).

What is Terraform Custom Function in Provider Framework?

User-defined HCL functions exposed by modern provider plugins to execute specialized string/crypto transformations.

What is Terragrunt Hooks?

Executing custom scripts or CLI commands before or after Terraform execution (before_hook, after_hook).

What is OpenTofu Registry Mirroring?

Redirecting provider and module downloads to private enterprise mirrors in air-gapped environments.

What is Ansible Meta Dependencies (meta/main.yml)?

Declaring prerequisite roles that must be executed automatically before the parent role runs.

What is Ansible Custom Filter Plugin?

Writing custom Python functions to extend Jinja2 template transformations inside playbooks.

What is Pulumi ComponentResource?

A higher-level logical resource that aggregates multiple primitive cloud resources into a single reusable component.

What is Crossplane Provider Config?

A Kubernetes CRD defining authentication credentials and assume-role configurations for a specific cloud provider in Crossplane.

What is Terraform Flatten Function (flatten())?

Flattens nested lists of lists into a single flat list, commonly used with nested dynamic block collections.

What is Terraform Element Function (element())?

Retrieves an element from a list at a given index with wrap-around modulo behavior.

What is Terraform SetProduct Function (setproduct())?

Computes the Cartesian product of multiple sets or lists to generate combinations of environments and subnets.

What is Terraform Zipmap Function (zipmap())?

Constructs a map from a list of keys and a corresponding list of values.

What is Terraform One Function (one())?

Converts a zero- or one-element list into a scalar value or null, failing if the list contains multiple elements.

What is OpenTofu State Encryption Key Derivation?

Using PBKDF2 with SHA256 to derive encryption keys from passphrases for local and remote state encryption.

What is Terragrunt Auto-Init?

Terragrunt automatically executes terraform init when backend settings or provider configurations change.

What is Ansible Lookups (lookup())?

Querying external data sources (environment variables, HashiCorp Vault, AWS SSM) dynamically during playbook execution.

What is Ansible Lineinfile Module?

Ensuring a specific line of text exists or is modified in a file using regex matching.

What is Pulumi Stack Output Reference?

Reading exported output values from another Pulumi stack (new StackReference("org/proj/prod")).

What is Crossplane Management Policies?

Granularly controlling which CRUD operations Crossplane is allowed to perform on a cloud resource (ObserveOnly, Create, Update, Delete).

What is Terraform Module Git Source Syntax?

Referencing modules in Git with tags: source = "git::https://github.com/org/repo.git?ref=v1.2.0".

What is Terraform Sub-directory Git Source?

Referencing modules in subdirectories of a Git repo: source = "git::https://github.com/org/repo.git//modules/vpc?ref=v1.2.0".

What is Terraform Provider Invalidation?

Forcing re-download of provider plugins by deleting the .terraform/providers directory.

What is Terraform Cloud Workspace VCS Integration?

Automatically triggering terraform plan and terraform apply on Git commits to specific branches in GitHub/GitLab.

What is OpenTofu Test Framework (tofu test)?

Native testing framework evaluating HCL assertion blocks against ephemeral infrastructure without third-party test engines.

What is Terragrunt Include Block?

Inheriting configuration from a parent terragrunt.hcl file into child environment directories.

What is Ansible Become (become: true)?

Privilege escalation system executing tasks with sudo or root permissions on target nodes.

What is Ansible Tags (--tags)?

Executing a subset of tasks in a playbook marked with specific tag labels.

What is Pulumi Cloud Provider Dynamic Providers?

Authoring custom providers in TypeScript/Python implementing CRUD methods for bespoke REST APIs.

What is Crossplane Composition Patching?

Mapping fields from an abstract Claim manifest (e.g., storage size) into underlying concrete cloud resources (e.g., EBS volume spec).

What is Terraform State Refresh Only (terraform apply -refresh-only)?

Updates the state file to reflect live cloud attributes without modifying any live cloud resources.

What is Terraform Target Flag (-target) and why is it an anti-pattern?

Restricting plan/apply to a single resource. Risk: Bypasses dependency graph tracking, causing orphaned resources and drift.

What is Terraform Parallelism Flag (-parallelism=N)?

Controls how many concurrent resource operations Terraform executes in parallel (default: 10).

What is OpenTofu Provider Signature Verification Failure?

Occurs when a downloaded provider plugin's checksum does not match .terraform.lock.hcl, indicating corrupted files or tampering.

What is Terragrunt Generate Block?

Automatically generates boilerplate .tf files (provider configs, backend configs) in working directories dynamically before execution.

What is Ansible Stat Module?

Retrieves filesystem status and metadata (existence, permissions, checksum) of a file on remote hosts.

What is Ansible Template vs Copy Module?

copy copies static files byte-for-byte; template renders dynamic variables and loops via Jinja2 before copying.

What is Pulumi Dynamic Secrets?

Integrating Pulumi with HashiCorp Vault to issue short-lived credentials dynamically during cloud provisioning.

What is Crossplane Reconcile Rate Limit?

Configuring controller reconcile intervals to prevent hitting cloud provider API rate limits.

What is Terraform State Lock ID?

A unique UUID generated when an operation begins, recorded in the lock store to identify the locking process.

What is Terraform Plan Compact Warnings (-compact-warnings)?

Condenses warning outputs in CLI terminal output for cleaner logs.

What is Terraform Debug Logging (TF_LOG=DEBUG)?

Enables verbose internal debugging logs printing raw cloud API HTTP requests and response payloads.

What is OpenTofu Migration Guide from Terraform 1.6+?

OpenTofu provides drop-in CLI replacement for Terraform configs and state files.

What is Terragrunt Dry-Run?

Validating configuration inheritance without executing underlying Terraform binaries.

What is Ansible Vault Rekey (ansible-vault rekey)?

Changing the encryption password of an existing Ansible Vault encrypted file.

What is Ansible Facts Cache?

Persisting gathered host facts across playbook runs using Redis or JSON files to speed up execution.

What is Pulumi Native Providers?

Auto-generated providers derived directly from cloud provider OpenAPI specs (e.g., pulumi-aws-native), providing zero-day support for new cloud APIs.

What is Crossplane Provider-Kubernetes?

Managing arbitrary Kubernetes resources in target clusters using Crossplane CRDs.

What is Terraform Workspace Delete (terraform workspace delete)?

Deletes an empty workspace; fails if resources are still tracked in the workspace state.

What is Terraform Output JSON Format (terraform output -json)?

Emits all module output values in machine-readable JSON format for scripting.

What is OpenTofu Registry Authentication?

Configuring access tokens in CLI config to authenticate to private OpenTofu module registries.

What is Terragrunt Local Inputs?

Passing environment-specific variables directly into Terraform modules from terragrunt.hcl.

What is Ansible Galaxy Requirements (requirements.yml)?

Declaring third-party roles and collections to be downloaded automatically before playbook execution.

What is Pulumi Policy as Code Enforcement Level (mandatory vs advisory)?

advisory prints warnings; mandatory blocks stack updates if compliance rules are violated.

What is Crossplane Health Status (Ready: True)?

Kubernetes condition indicating that the underlying live cloud resource has been successfully provisioned, initialized, and is fully functional.