Environment variables (TF_VAR_) in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does Terraform use environment variables prefixed with TF_VAR_?

Terraform allows setting input variables using environment variables prefixed with TF_VAR_. What happens when you set TF_VAR_region=us-west-2 before running terraform apply?

A Terraform automatically assigns the value 'us-west-2' to the input variable named 'region'.

B Terraform ignores environment variables and requires variables to be set only in .tf files.

C Terraform treats 'TF_VAR_region' as a resource name and creates a resource called 'region'.

D Terraform throws an error because environment variables cannot be used for variables.

💡 Hint

Think about how environment variables can provide values to Terraform variables without editing files.

Terraform reads environment variables starting with TF_VAR_ and assigns their values to input variables matching the suffix. This allows dynamic configuration without changing code.

❓ Configuration

intermediate

What is the value of the variable 'instance_type' after applying this configuration with environment variable set?

Given the Terraform variable declaration and environment variable below, what value will instance_type have during terraform apply?

variable "instance_type" {
  type    = string
  default = "t2.micro"
}

Environment variable set before running Terraform:

export TF_VAR_instance_type="m5.large"

A "m5.large"

B null

C "t2.micro"

D Terraform throws an error due to conflicting values

💡 Hint

Environment variables override default values in Terraform variables.

The environment variable TF_VAR_instance_type overrides the default value of the variable instance_type. Terraform uses the environment variable value.

❓ Architecture

advanced

How to securely manage sensitive variables using TF_VAR_ environment variables?

You want to pass a sensitive variable like a database password to Terraform without storing it in code or state files. Which approach using TF_VAR_ environment variables is best practice?

A Store the sensitive value in a public GitHub repository as a <code>TF_VAR_</code> environment variable.

B Hardcode the sensitive value in the Terraform variable default to avoid environment variables.

C Set the sensitive variable as a <code>TF_VAR_</code> environment variable only in your local shell before running Terraform, and mark the variable as sensitive in Terraform.

D Pass the sensitive variable as a plain text command line argument to <code>terraform apply</code>.

💡 Hint

Think about avoiding storing secrets in code or version control.

Setting sensitive variables as environment variables locally and marking them sensitive in Terraform avoids storing secrets in code or state files. This is a secure practice.

❓ service_behavior

advanced

What happens if a required variable is not set and no TF_VAR_ environment variable exists?

Consider a Terraform variable declared as:

variable "region" {
  type = string
}

No default is set. You do not set TF_VAR_region or provide the variable in any other way. What will happen when you run terraform apply?

A Terraform applies with a null value for 'region' without error.

B Terraform uses an empty string as the value for 'region'.

C Terraform fails immediately with a syntax error.

D Terraform prompts you to enter a value interactively before applying.

💡 Hint

Think about how Terraform handles required variables without defaults or environment variables.

Terraform requires values for variables without defaults. If no value is provided via environment variables or files, it prompts the user interactively.

❓ security

expert

Why is relying solely on TF_VAR_ environment variables for secrets risky in CI/CD pipelines?

In a CI/CD pipeline, you set sensitive secrets as TF_VAR_ environment variables to pass to Terraform. What is a key security risk of this approach?

A Terraform encrypts all environment variables automatically, so there is no risk.

B Environment variables can be exposed in logs or process listings, risking secret leakage.

C CI/CD pipelines do not support environment variables, so secrets are lost.

D Using TF_VAR_ variables disables Terraform state encryption.

💡 Hint

Consider how environment variables might be exposed during pipeline execution.

Environment variables can be visible in logs, error messages, or process lists in CI/CD environments, which can expose secrets if not handled carefully.