Terraform interview question · Most asked
A terraform plan wants to destroy and recreate a database. What do you do?
Summary
Stop and find out why before applying. Look at which attribute is marked # forces replacement: a changed immutable attribute (engine version major, subnet group, identifier), a renamed resource or module (use a moved block), a changed count index, or a provider upgrade changing defaults. Then fix the configuration so the plan shows an in-place update, or plan a deliberate migration.
Longer Answer
Safeguards to have in place before this happens: prevent_destroy on critical data stores, deletion protection on the resource itself (RDS deletion_protection), final snapshots, CI checks that flag destroy actions on protected resource types, and required human approval when plans contain replacements. If a replacement really is needed (for example to change encryption), migrate data explicitly with snapshots or replication rather than letting Terraform delete and recreate.
Key Points
- Find the 'forces replacement' attribute.
- Renames: moved blocks; index shifts: for_each.
- prevent_destroy + deletion protection.
- Flag destroys in CI; migrate data deliberately.
Explanation
What interviewers look for
Caution and a systematic look at the cause, plus guardrails so a destroy cannot slip through.
More most-asked Terraform questions
- How do you handle secrets in Terraform?
- How would you run Terraform in CI/CD?
- What is Terraform state, why is it needed, and where should it be stored?
- count or for_each: when do you use each?
- Walk through terraform init, plan and apply. What does each do?
- What is Terraform, and how does it work at a high level?
- What are Terraform modules, and how do you design good ones?
- What is drift, and how do you detect and handle it?