interview-prep

What happens during terraform init and what does the lock file do

Crisp answer: terraform init downloads provider plugins, sets up the backend, and installs modules. The .terraform.lock.hcl file records the exact provider versions downloaded so every team member and CI run uses identical binaries.

What terraform init does:

terraform init

  1. Backend initialisation: Configures the remote state backend (S3, Terraform Cloud, etc.) and migrates any existing local state if needed

  2. Provider installation: Downloads provider plugins from the Terraform Registry (or a custom mirror). Providers are stored in .terraform/providers/

  3. Module installation: Downloads any remote modules (Registry or git) into .terraform/modules/

terraform init -upgrade          # Upgrade providers to latest within constraints
terraform init -backend=false    # Skip backend init (useful for module development)
terraform init -reconfigure      # Reinitialise backend even if already configured
terraform init -migrate-state    # Migrate state to new backend config

The lock file — .terraform.lock.hcl:

provider "registry.terraform.io/hashicorp/aws" {
  version     = "5.58.0"
  constraints = "~> 5.0"
  hashes = [
    "h1:abc123...",
    "zh:def456...",
  ]
}

The lock file records:

  • The exact version selected within the constraint
  • Cryptographic hashes of the downloaded binary for integrity verification

Commit the lock file to version control. This ensures every developer and every CI run uses the exact same provider version. Without it, one developer might use aws provider 5.58.0 and another uses 5.59.0, leading to plan differences.

# Update providers and refresh the lock file:
terraform init -upgrade
git add .terraform.lock.hcl
git commit -m "chore: upgrade aws provider to 5.59.0"

What to say in the interview:

"terraform init sets up the working directory: downloads providers, installs modules, and configures the backend. The lock file is the important output to commit — it records the exact provider versions and their checksums. Without it, CI might download a different provider version than what developers tested with, and you get unexpected plan differences. I always commit the lock file. When deliberately upgrading a provider I run terraform init -upgrade, review the plan carefully, and commit the updated lock file as a deliberate change."

My notes