Terraform & IaC Interview Questions and Answers

Drift is a difference between real infrastructure and Terraform state, usually caused by manual changes.

Detect:

• terraform plan refreshes state and shows differences.
• terraform plan -refresh-only shows drift without proposing configuration changes.
• Scheduled CI plans on a branch detect drift automatically.

Respond:

1. Decide whether the manual change is desired.
2. If it should be reverted, run terraform apply to bring reality back to configuration.
3. If the change is wanted, update code, then apply. Use terraform state mv or import to reconcile.
4. Use terraform refresh or apply -refresh-only to update state from reality.

terraform plan -refresh-only
terraform import aws_s3_bucket.logs my-bucket

Prevent drift with policy: require all changes through CI, use read-only roles for humans, and enable AWS Config or Azure Policy alerts. Do not use terraform state rm to hide drift.

The lifecycle block controls how Terraform creates, updates, and destroys a resource.

• create_before_destroy: create the replacement before destroying the old one, reducing downtime for resources that must be replaced.
• prevent_destroy: fails the plan if the resource would be destroyed. Useful for databases and state buckets.
• ignore_changes: ignores changes to listed attributes, useful when an external system or autoscaler modifies them.
• replace_triggered_by: forces replacement when a referenced resource or attribute changes.
• precondition and postcondition: validate assumptions before or after an operation.

resource "aws_db_instance" "db" {
  lifecycle {
    prevent_destroy = true
    ignore_changes  = [tags["LastModified"]]
  }
}

Caveats: prevent_destroy does not protect against state removal or CLI deletes. ignore_changes can hide real drift. create_before_destroy requires no name conflicts. Use these deliberately and document why.