State locking with DynamoDB in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Terraform backend configuration for DynamoDB state locking

Which Terraform backend configuration snippet correctly enables state locking using a DynamoDB table named tf-lock-table in the us-west-2 region?

A

backend "s3" {
  bucket         = "my-terraform-state"
  key            = "state.tfstate"
  region         = "us-west-2"
  dynamodb_table = "tf-lock-table"
}

B

backend "s3" {
  bucket         = "my-terraform-state"
  key            = "state.tfstate"
  region         = "us-west-2"
  dynamodb_table = "tf-lock-table"
  encrypt        = false
}

C

}
eurt =        tpyrcne  
"elbat-kcol-ft" = elbat_bdomanyd  
"2-tsew-su" =         noiger  
"etatsft.etats" =            yek  
"etats-mrofarret-ym" =         tekcub  
{ "3s" dnekcab

D

backend "s3" {
  bucket         = "my-terraform-state"
  key            = "state.tfstate"
  region         = "us-west-2"
  dynamodb_table = "tf-lock-table"
  encrypt        = true
}

💡 Hint

Look for the correct attribute name to enable DynamoDB state locking and ensure encryption is enabled.

The correct attribute to enable state locking with DynamoDB in Terraform's S3 backend is dynamodb_table. Encryption should be enabled for security best practices.

❓ Architecture

intermediate

DynamoDB table design for Terraform state locking

Which DynamoDB table design is required to support Terraform state locking correctly?

A A table with a primary key named <code>LockID</code> of type string, with no sort key.

B A table with a composite primary key: partition key <code>LockID</code> (string) and sort key <code>StateID</code> (string).

C A table with a primary key named <code>StateName</code> of type number.

D A table with no primary key but with a global secondary index on <code>LockID</code>.

💡 Hint

Terraform expects a simple primary key named LockID for locking.

Terraform requires a DynamoDB table with a simple primary key named LockID of type string to manage locks properly.

❓ service_behavior

advanced

Effect of missing DynamoDB table on Terraform state locking

What happens when Terraform tries to acquire a lock using a DynamoDB table that does not exist?

A Terraform will create the DynamoDB table automatically and acquire the lock.

B Terraform will fail with an error indicating the DynamoDB table does not exist and stop the operation.

C Terraform will skip locking and proceed with state changes without any warning.

D Terraform will retry indefinitely until the table is created.

💡 Hint

Terraform requires the DynamoDB table to exist before locking.

Terraform does not create the DynamoDB table automatically. If the table is missing, it fails with an error and stops to prevent unsafe state changes.

❓ security

advanced

IAM policy for Terraform to use DynamoDB state locking

Which IAM policy snippet grants the minimum required permissions for Terraform to use DynamoDB state locking on a table named tf-lock-table?

A

{
  "Effect": "Allow",
  "Action": ["dynamodb:CreateTable", "dynamodb:DeleteTable"],
  "Resource": "arn:aws:dynamodb:*:*:table/tf-lock-table"
}

B

{
  "Effect": "Allow",
  "Action": ["dynamodb:Scan", "dynamodb:Query"],
  "Resource": "arn:aws:dynamodb:*:*:table/tf-lock-table"
}

C

{
  "Effect": "Allow",
  "Action": ["dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem"],
  "Resource": "arn:aws:dynamodb:*:*:table/tf-lock-table"
}

D

{
  "Effect": "Allow",
  "Action": ["dynamodb:UpdateItem"],
  "Resource": "arn:aws:dynamodb:*:*:table/tf-lock-table"
}

💡 Hint

Terraform needs to create, read, and delete lock items.

Terraform requires permissions to put, get, and delete items in the DynamoDB table to manage locks properly.

✅ Best Practice

expert

Ensuring high availability for Terraform state locking with DynamoDB

Which approach best ensures high availability and durability for Terraform state locking using DynamoDB in a multi-region AWS setup?

A Use DynamoDB global tables to replicate the lock table across multiple regions and configure Terraform to use the global table endpoint.

B Create multiple DynamoDB tables in each region and configure Terraform to switch tables based on region manually.

C Create a single DynamoDB table in one region and configure Terraform to use that region only.

D Use S3 versioning instead of DynamoDB for locking to avoid regional dependency.

💡 Hint

Think about automatic replication and consistency across regions.

DynamoDB global tables replicate data across regions automatically, providing high availability and durability for state locking in multi-region setups.