HashiCorp Certified: Terraform Associate (003) Practice Questions

False. The sensitive = true argument is a UI affordance. It tells the Terraform CLI to redact the value from console output (e.g., in plan or apply logs). However, the value is still recorded in the state file in plaintext. This is why securing the state file itself (e.g., using an encrypted remote backend) is a critical security best practice.

Sentinel is the policy-as-code framework integrated with HCP Terraform. It allows you to define fine-grained, logic-based policies on Terraform runs. A Sentinel policy can be written to inspect the planned changes (tfplan import) and check the configuration of all resources of type aws_s3_bucket. If the versioning block is missing or disabled, the policy can fail the run before any infrastructure is applied, thus enforcing the organizational requirement.

When for_each is used, the resource (aws_instance.web) behaves as a map of objects, where the keys are the items from the for_each set and the values are the instance objects. The splat operator ([*]) only works on lists. To get a list of the instance objects from the map, you must first use the values() function. After applying values(), you have a list of objects, and then the splat operator can be used to extract the public_ip from each object in the list.

In terraform plan output, the ~ (tilde) symbol indicates an in-place update. This means Terraform has detected a change in one or more arguments of the resource that the provider can modify without destroying and recreating the resource itself (e.g., changing tags on an EC2 instance).

Terraform's plugin-based architecture allows it to manage multiple disparate platforms simultaneously. The correct approach is to include a required_providers block for both google and vsphere, and then configure each provider in its own provider block with the necessary credentials and settings. Resources from each provider can then be defined in the same configuration.

The correct way to handle multiple configurations for the same provider is by using the alias attribute in the provider block. This creates distinct provider instances. Each module can then be instructed to use a specific provider instance by passing a map to the providers meta-argument within the module block, mapping the provider name (e.g., aws) to the aliased name (e.g., aws.tenant_a). This ensures that each module's resources are managed exclusively by the provider instance configured with that tenant's credentials.

Modules are encapsulated and do not automatically inherit aliased providers from the calling module. To use multiple provider configurations within a single module, the module must be explicitly designed to accept them. This is done by defining multiple provider requirements within the module's own terraform block and then passing the correctly configured provider instances from the root module via the providers meta-argument. The root module would map its aliased providers to the provider names expected by the child module, such as providers = { aws.main = aws, aws.logging = aws.security }.

When a resource is created using for_each, its instances are accessed like a map. The general format is . [" "]. In this case, the resource is aws_instance.server, and the key for the desired instance is "app-1". Therefore, aws_instance.server["app-1"] references the specific instance object, and .availability_zone accesses its attribute.

False. The terraform state replace-provider command is used when a provider's source address changes (e.g., moving from a community fork to an official version), not for version upgrades. The recommended method for upgrading a provider version is to update the version constraint in the required_providers block and then run terraform init -upgrade to download the new version and update the lock file.

A dynamic block is specifically designed for this purpose. It iterates over a complex type (like a list of objects) and generates a nested block (like ingress) for each item in the collection. By setting for_each to the variable containing the list of rules, you can use the iterator (e.g., ingress.value) to access the attributes of each rule object and populate the content of the generated block.