Preconditions and postconditions in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Terraform precondition blocks usage

Given the following Terraform resource configuration, what will happen if the variable instance_count is set to 0?

resource "aws_instance" "example" {
  count = var.instance_count

  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    precondition {
      condition     = var.instance_count > 0
      error_message = "instance_count must be greater than zero"
    }
  }
}

A Terraform plan will fail with error: "instance_count must be greater than zero".

B Terraform plan will succeed and create zero instances without error.

C Terraform apply will fail but plan will succeed.

D Terraform plan will ignore the precondition and create one instance.

💡 Hint

Preconditions in lifecycle blocks run during plan phase to validate conditions.

The precondition checks if instance_count is greater than zero. If it is zero, the plan fails with the specified error message.

❓ service_behavior

intermediate

Terraform postcondition effect on resource creation

Consider this Terraform resource with a postcondition:

resource "aws_s3_bucket" "bucket" {
  bucket = var.bucket_name

  lifecycle {
    postcondition {
      condition     = length(aws_s3_bucket.bucket.id) > 0
      error_message = "Bucket ID must be set after creation"
    }
  }
}

What happens if after bucket creation, no ID is assigned?

A Terraform apply will fail after resource creation with the postcondition error.

B Terraform apply will succeed but postcondition error is ignored.

C Terraform plan will fail before apply due to postcondition.

D Terraform apply will retry bucket creation until postcondition passes.

💡 Hint

Postconditions run after resource creation to validate state.

If the postcondition fails after resource creation, Terraform apply fails with the error message to prevent inconsistent state.

❓ Architecture

advanced

Designing Terraform modules with preconditions and postconditions

You are designing a Terraform module that creates an AWS RDS instance. You want to ensure:
1. The allocated storage is at least 20 GB before creation.
2. After creation, the instance endpoint is not empty.

Which lifecycle blocks correctly enforce these preconditions and postconditions?

A

lifecycle {
  precondition {
    condition     = length(aws_db_instance.db.endpoint) > 0
    error_message = "Endpoint must be set after creation"
  }
  postcondition {
    condition     = var.allocated_storage >= 20
    error_message = "Storage must be at least 20 GB"
  }
}

B

lifecycle {
  precondition {
    condition     = var.allocated_storage >= 20
    error_message = "Storage must be at least 20 GB"
  }
  postcondition {
    condition     = length(aws_db_instance.db.endpoint) > 0
    error_message = "Endpoint must be set after creation"
  }
}

C

lifecycle {
  precondition {
    condition     = var.allocated_storage > 0
    error_message = "Storage must be positive"
  }
  postcondition {
    condition     = aws_db_instance.db.endpoint != null
    error_message = "Endpoint must be set after creation"
  }
}

D

lifecycle {
  precondition {
    condition     = var.allocated_storage >= 20
    error_message = "Storage must be at least 20 GB"
  }
}

💡 Hint

Preconditions check inputs before creation; postconditions check resource attributes after creation.

Option B correctly places the storage size check as a precondition and the endpoint existence as a postcondition. Option B reverses them incorrectly. Option B uses a weaker precondition and a null check that may not work as expected. Option B misses the postcondition.

❓ security

advanced

Using preconditions to enforce security policies in Terraform

You want to enforce that all AWS EC2 instances created by Terraform use an approved security group ID stored in var.approved_sg_ids. Which precondition block correctly enforces this?

A

precondition {
  condition     = length(aws_instance.example.vpc_security_group_ids) > 0
  error_message = "Instance must have a security group"
}

B

precondition {
  condition     = aws_instance.example.vpc_security_group_ids[0] == var.approved_sg_ids[0]
  error_message = "Security group is not approved"
}

C

precondition {
  condition     = aws_instance.example.vpc_security_group_ids != null
  error_message = "Security group must be assigned"
}

D

precondition {
  condition     = contains(var.approved_sg_ids, aws_instance.example.vpc_security_group_ids[0])
  error_message = "Security group is not approved"
}

💡 Hint

Use the contains function to check membership in a list.

Option D correctly checks if the instance's first security group ID is in the approved list. Option D only compares to the first approved ID, which is too restrictive. Options C and D only check presence, not approval.

✅ Best Practice

expert

Ensuring consistent infrastructure state with postconditions in Terraform

You have a Terraform resource that creates an Azure Storage Account. You want to ensure that after creation, the storage account's primary endpoint URL starts with https://. Which postcondition block correctly enforces this?

A

postcondition {
  condition     = substr(azurerm_storage_account.example.primary_blob_endpoint, 0, 8) == "https://"
  error_message = "Primary endpoint must use HTTPS"
}

B

postcondition {
  condition     = contains(azurerm_storage_account.example.primary_blob_endpoint, "https://")
  error_message = "Primary endpoint must use HTTPS"
}

C

postcondition {
  condition     = startswith(azurerm_storage_account.example.primary_blob_endpoint, "https://")
  error_message = "Primary endpoint must use HTTPS"
}

D

postcondition {
  condition     = azurerm_storage_account.example.primary_blob_endpoint != null
  error_message = "Primary endpoint must be set"
}

💡 Hint

Use the startswith function for prefix checks.

Option C uses the startswith function correctly to check the URL prefix. Option C uses slicing which is error-prone and less readable. Option C only checks if 'https://' appears anywhere, which is insufficient. Option C only checks presence, not the prefix.