Terraform interview question · Most asked
How would you run Terraform in CI/CD?
Summary
On every pull request: fmt -check, validate, linting and security scanning, then plan -out with the plan posted to the PR. After review and approval: apply that saved plan from a pipeline with locked, audited credentials, one environment at a time. Tools such as Atlantis, HCP Terraform, Spacelift, env0 or GitHub Actions workflows implement this.
Longer Answer
Important details: authenticate CI to the cloud with OIDC federation and short-lived roles (separate plan-only and apply roles); ensure only one apply per state at a time (locking, pipeline concurrency); require approvals for production; keep plan artifacts for audit; and run scheduled drift-detection plans. Never let engineers apply production from laptops as normal practice.
Key Points
- PR: fmt, validate, scan, plan.
- Apply the reviewed plan after approval.
- OIDC credentials; plan vs apply roles.
- No routine laptop applies to prod.
More most-asked Terraform questions
- How do you handle secrets in Terraform?
- A terraform plan wants to destroy and recreate a database. What do you do?
- What is Terraform state, why is it needed, and where should it be stored?
- count or for_each: when do you use each?
- Walk through terraform init, plan and apply. What does each do?
- What is Terraform, and how does it work at a high level?
- What are Terraform modules, and how do you design good ones?
- What is drift, and how do you detect and handle it?