interview-prep

What is Terraform and how does it work

Crisp answer: Terraform is an infrastructure-as-code tool that lets you describe what infrastructure you want in declarative HCL config files. It compares your desired state against current reality, plans the changes needed to reconcile them, and executes those changes through provider APIs.

The core loop:

Write HCL config  →  terraform plan  →  terraform apply  →  infrastructure exists
      ↑                                                              |
      └──────────────── make changes, repeat ───────────────────────┘

Declarative vs imperative:

Imperative (AWS CLI, scripts): you tell the tool exactly what to do step by step.

# Imperative: you manage the steps
aws ec2 run-instances --image-id ami-123 --instance-type t3.micro
aws ec2 create-tags --resources i-abc --tags Key=Name,Value=web
aws ec2 create-security-group --group-name app-sg --description "app"
aws ec2 authorize-security-group-ingress --group-id sg-xyz --protocol tcp --port 443 --cidr 0.0.0.0/0

Declarative (Terraform): you describe the end state, Terraform figures out the steps.

# Declarative: describe what you want
resource "aws_instance" "web" {
  ami           = "ami-123"
  instance_type = "t3.micro"
  tags = { Name = "web" }
}

resource "aws_security_group" "app" {
  name = "app-sg"
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

How Terraform executes:

  1. Init: Download provider plugins, configure backend, install modules
  2. Refresh: Query real infrastructure to update state with current values
  3. Plan: Diff desired config against state to produce a list of actions
  4. Apply: Execute the actions via provider API calls (AWS, GCP, etc.)
  5. State update: Record the result of each action in the state file

Providers:

Providers are plugins that translate Terraform resource definitions into real API calls. The AWS provider translates aws_instance blocks into EC2 API calls. There are providers for AWS, Azure, GCP, Kubernetes, Vault, GitHub, Cloudflare, and thousands more.

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
  }
}

provider "aws" {
  region = "eu-west-2"
}

What to say in the interview:

"Terraform is declarative IaC. You describe the desired end state in HCL and Terraform figures out what API calls to make to get there. The key components are providers, which are plugins that talk to specific APIs, and state, which records what Terraform created so it can calculate diffs on the next plan. The core workflow is init once per project, then the plan-apply loop for every change."

My notes