HashiCorp Terraform Associate (003) - Fact Sheet¶

Quick Reference¶

Exam Code: Terraform Associate (003) Duration: 60 minutes Questions: 57 questions Passing Score: 70% Cost: $70.50 USD Validity: 2 years Difficulty: ⭐⭐⭐

Exam Domains¶

Infrastructure as Code Fundamentals¶

IaC Key Concepts¶

• Infrastructure defined in human-readable configuration files
• Version controlled, reusable, shareable
• Declarative approach - describe desired end state
• Idempotent - running multiple times produces the same result
• Terraform uses HCL (HashiCorp Configuration Language)
• 📖 What is Infrastructure as Code - IaC concepts introduction
• 📖 IaC in Terraform Intro - Terraform overview and use cases

IaC Tool Comparison¶

Terraform vs Others¶

• Multi-cloud support: Works across AWS, Azure, GCP, and hundreds of providers
• State management: Tracks actual infrastructure state
• Execution plans: Preview changes before applying
• Resource graph: Understands dependencies automatically
• Provider ecosystem: 3000+ providers in the registry
• 📖 Terraform Use Cases - Common Terraform use cases

HCL Configuration Language¶

Configuration File Structure¶

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "example" {
  ami           = var.ami_id
  instance_type = var.instance_type

  tags = {
    Name = "example-instance"
  }
}

Block Types¶

• terraform: Settings, required providers, backend configuration
• provider: Provider configuration and authentication
• resource: Infrastructure objects to create/manage
• data: Query existing infrastructure or external data
• variable: Input parameters for configurations
• output: Return values from configurations
• locals: Named expressions for reuse within a module
• module: Call reusable child modules
• 📖 Configuration Language - Complete HCL reference
• 📖 Resource Blocks - Resource configuration syntax

Variable Types¶

variable "string_var" {
  type    = string
  default = "hello"
}

variable "number_var" {
  type    = number
  default = 42
}

variable "bool_var" {
  type    = bool
  default = true
}

variable "list_var" {
  type    = list(string)
  default = ["a", "b", "c"]
}

variable "map_var" {
  type    = map(string)
  default = { key = "value" }
}

variable "object_var" {
  type = object({
    name = string
    age  = number
  })
}

Variable Precedence (lowest to highest)¶

1. Default values in variable block
2. terraform.tfvars file
3. *.auto.tfvars files (alphabetical order)
4. -var-file flag
5. -var flag

6. TF_VAR_ environment variables

7. 📖 Input Variables - Variable definitions and usage

8. 📖 Output Values - Output configuration
9. 📖 Local Values - Local named values

Meta-Arguments¶

• depends_on: Explicit dependency declaration
• count: Create multiple instances by count
• for_each: Create instances from a map or set
• provider: Select non-default provider configuration
• lifecycle: Customize resource lifecycle behavior
• create_before_destroy
• prevent_destroy
• ignore_changes
• replace_triggered_by
• 📖 Meta-Arguments - Resource meta-arguments reference

Built-in Functions (Key Categories)¶

• String: format, join, split, replace, trim, upper, lower
• Collection: length, merge, lookup, flatten, keys, values
• Numeric: max, min, ceil, floor, abs
• Filesystem: file, fileexists, templatefile, pathexpand
• Type Conversion: tostring, tolist, tomap, tonumber, tobool
• Encoding: base64encode, jsonencode, yamlencode
• 📖 Built-in Functions - Complete function reference

Providers and Resources¶

Provider Configuration¶

• Providers are plugins that interact with cloud platforms and services
• Each provider has its own resources and data sources
• Providers are downloaded during terraform init
• Version constraints: =, !=, >, >=, <, <=, ~>
• ~> (pessimistic constraint) allows only the rightmost version component to increment
• 📖 Provider Configuration - Provider setup and versioning
• 📖 Provider Requirements - Required providers block
• 📖 Terraform Registry Providers - Browse all providers

Provider Aliases¶

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

resource "aws_instance" "west_instance" {
  provider      = aws.west
  ami           = "ami-12345678"
  instance_type = "t3.micro"
}

Resource Behavior¶

• Create: Resources that exist in config but not in state
• Destroy: Resources that exist in state but not in config
• Update in-place: Resources with changed attributes that can be updated
• Destroy and re-create: Resources with changed attributes that require replacement
• 📖 Resource Behavior - How Terraform manages resources

Data Sources¶

• Read-only queries to existing infrastructure
• Populated during the plan phase
• Used to reference resources not managed by current configuration
• 📖 Data Sources - Data source configuration

Core Terraform Workflow¶

Command Reference¶

• 📖 CLI Commands - Complete CLI reference
• 📖 Terraform Init - Initialization command
• 📖 Terraform Plan - Plan command
• 📖 Terraform Apply - Apply command

Init Details¶

• Downloads and installs providers
• Initializes backend for state storage
• Downloads referenced modules
• Creates .terraform directory and .terraform.lock.hcl
• Must be run when: adding providers, changing backends, adding modules
• 📖 Dependency Lock File - Lock file management

State Management¶

State File Purpose¶

• Maps configuration to real-world resources
• Tracks metadata and resource dependencies
• Performance optimization for large infrastructures
• Default location: terraform.tfstate (local)
• Format: JSON
• Contains sensitive data - must be secured
• 📖 State - State overview
• 📖 Purpose of State - Why Terraform uses state

Remote Backends¶

• 📖 Backend Configuration - Backend types and setup
• 📖 S3 Backend - AWS S3 backend configuration
• 📖 Remote State - Remote state storage

State Commands¶

terraform state list                    # List resources in state
terraform state show <resource>         # Show resource details
terraform state mv <source> <dest>      # Move/rename resource in state
terraform state rm <resource>           # Remove resource from state
terraform state pull                    # Pull remote state to stdout
terraform state push                    # Push local state to remote
terraform state replace-provider        # Replace provider in state

State Locking¶

• Prevents concurrent modifications to state
• Automatic for supported backends
• Manual unlock: terraform force-unlock <LOCK_ID>
• Not all backends support locking
• 📖 State Locking - Locking mechanism details

Modules¶

Module Structure¶

modules/
  my-module/
    main.tf          # Primary resources
    variables.tf     # Input variables
    outputs.tf       # Output values
    README.md        # Documentation

Module Sources¶

# Local path
module "vpc" {
  source = "./modules/vpc"
}

# Terraform Registry
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"
}

# GitHub
module "vpc" {
  source = "github.com/hashicorp/example"
}

# S3 bucket
module "vpc" {
  source = "s3::https://s3.amazonaws.com/bucket/module.zip"
}

• 📖 Modules Overview - Module concepts
• 📖 Module Sources - Where to find modules
• 📖 Terraform Registry Modules - Browse public modules
• 📖 Module Composition - Module design patterns
• 📖 Publishing Modules - Publishing to the registry

Module Best Practices¶

• Use semantic versioning for module versions
• Minimize module inputs - use sensible defaults
• Document all variables and outputs
• Use validation blocks for input validation
• Nest modules for complex infrastructure patterns

Workspaces¶

Workspace Commands¶

terraform workspace list      # List all workspaces
terraform workspace new dev   # Create new workspace
terraform workspace select dev # Switch to workspace
terraform workspace delete dev # Delete workspace
terraform workspace show      # Show current workspace

Workspace Use Cases¶

• Managing multiple environments (dev, staging, prod)
• Each workspace has its own state file
• Default workspace cannot be deleted
• State stored in terraform.tfstate.d/<workspace>/
• Access current workspace: terraform.workspace
• 📖 Workspaces - Workspace management

Import and Migration¶

Terraform Import¶

terraform import aws_instance.example i-1234567890abcdef0

Import Block (Terraform 1.5+)¶

import {
  to = aws_instance.example
  id = "i-1234567890abcdef0"
}

Provisioners¶

Types¶

• local-exec: Run commands on the machine running Terraform
• remote-exec: Run commands on the remote resource
• file: Copy files to the remote resource

Key Points¶

• Provisioners are a last resort - prefer native provider features
• Run only during creation by default
• when = destroy runs during resource destruction
• on_failure = continue or on_failure = fail
• Not stored in state - not re-run on subsequent applies
• 📖 Provisioners - Provisioner configuration

Debugging and Troubleshooting¶

TF_LOG Levels¶

• TRACE - Most verbose
• DEBUG - Debug information
• INFO - General information
• WARN - Warning messages
• ERROR - Error messages only

Environment Variables¶

export TF_LOG=DEBUG
export TF_LOG_PATH=./terraform.log
export TF_LOG_CORE=TRACE
export TF_LOG_PROVIDER=DEBUG

Terraform Cloud and Enterprise¶

Terraform Cloud Features¶

• Remote state management with encryption
• Remote plan and apply execution
• Team management and governance
• Policy as Code with Sentinel
• Private module registry
• VCS integration
• Cost estimation
• 📖 Terraform Cloud - Terraform Cloud documentation

Cloud Block Configuration¶

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "my-workspace"
    }
  }
}

Exam Tips¶

High-Value Topics (by weight)¶

1. Terraform basics (20%): HCL syntax, resources, providers, dependencies
2. IaC concepts (15%): Benefits, patterns, comparisons
3. Purpose of Terraform (15%): Multi-cloud, state benefits, workflow
4. Core workflow (15%): init, plan, apply, destroy commands and flags
5. State management (15%): Backends, locking, state commands
6. Outside core workflow (10%): Import, workspaces, debugging
7. Modules (10%): Sources, versioning, inputs/outputs

Common Exam Traps¶

• Variable precedence order (environment variables are highest priority)
• terraform refresh is deprecated - use terraform plan -refresh-only
• Provisioners are a last resort, not a best practice
• count and for_each cannot be used together on the same resource
• State locking requires specific backend support (S3 needs DynamoDB)
• terraform.workspace returns "default" in default workspace
• -auto-approve skips the interactive approval, not validation
• terraform init must be run when changing backend configuration