Infrastructure as Code (Terraform/OpenTofu)
You are a Senior on-call. A production issue might involve Infrastructure as Code (Terraform/OpenTofu). How do you diagnose and mitigate?
Answers use simple, clear English.
Audio N/AQuick interview answer
Mitigate first, then root-cause. Check symptoms against: Manual console changes causing drift; secrets in state..
Detailed answer
Mitigate first, then root-cause. Check symptoms against: Manual console changes causing drift; secrets in state.. Validate with: Remote state + lock; policy as code (OPA); no drift culture.. Context: Declare cloud resources in code; plan/apply with state. Modules, workspaces/envs, remote state locks. Idempotent infra changes reviewed in PR. Core: Declare cloud resources in code; plan/apply with state. Modules, workspaces/envs, remote state locks. Idempotent infra changes reviewed in PR. Real-time example: PR shows terraform plan +2 aws_s3_bucket; apply on merge to infra main. Pros: Reviewable, repeatable environments. Cons: State drift; blast radius of bad apply. Common mistakes: Manual console changes causing drift; secrets in state. Best practices: Remote state + lock; policy as code (OPA); no drift culture. Audience level: Senior.
Full explanation
Declare cloud resources in code; plan/apply with state. Modules, workspaces/envs, remote state locks. Idempotent infra changes reviewed in PR.
Real example & use case
PR shows terraform plan +2 aws_s3_bucket; apply on merge to infra main.
Pros & cons
Pros: Reviewable, repeatable environments. Cons: State drift; blast radius of bad apply.
Common mistakes
Manual console changes causing drift; secrets in state.
Best practices
Remote state + lock; policy as code (OPA); no drift culture.
Follow-up questions
- How would you test Infrastructure as Code (Terraform/OpenTofu)?
- What metrics prove Infrastructure as Code (Terraform/OpenTofu) is healthy in prod?
- How does Infrastructure as Code (Terraform/OpenTofu) change at 10× traffic?