Terraform in GitLab CI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Terraform GitLab CI Pipeline Stage Order

Given the following GitLab CI stages for Terraform, what is the correct order to ensure safe infrastructure deployment?

A 1,2,3,4

B 2,1,3,4

C 3,1,2,4

D 1,3,2,4

💡 Hint

Initialization must happen before validation and planning.

Terraform requires initialization first to set up backend and providers, then validation to check syntax, planning to preview changes, and finally apply to execute changes.

❓ security

intermediate

Protecting Terraform State in GitLab CI

Which option best secures Terraform state files when running Terraform in GitLab CI pipelines?

A Disable state locking to speed up pipeline execution.

B Store state files locally on the GitLab runner disk.

C Commit state files to the Git repository for versioning.

D Use a remote backend like AWS S3 with encryption and access control.

💡 Hint

State files contain sensitive info and must be protected and shared safely.

Using a remote backend with encryption and access control ensures state files are secure and consistent across pipeline runs.

❓ service_behavior

advanced

Terraform Apply Behavior in GitLab CI with Auto-Approve

What is the effect of adding the '-auto-approve' flag to 'terraform apply' in a GitLab CI pipeline?

A It automatically applies changes without waiting for user confirmation.

B It requires manual approval before applying changes.

C It only plans changes but does not apply them.

D It disables state locking during apply.

💡 Hint

Think about automation and manual steps in CI pipelines.

The '-auto-approve' flag skips the interactive approval prompt, allowing automated pipelines to apply changes without manual intervention.

❓ Architecture

advanced

Managing Multiple Environments with Terraform in GitLab CI

Which approach best isolates Terraform state and variables for multiple environments (e.g., dev, staging, prod) in GitLab CI?

A Use a single state file and switch variables inside the pipeline script.

B Run all environments in parallel using the same state and variables.

C Use separate Terraform workspaces or backend state files per environment.

D Store all environment states in one backend bucket without prefixes.

💡 Hint

Isolation prevents accidental cross-environment changes.

Separate workspaces or backend state files per environment keep state isolated and reduce risk of conflicts or accidental changes.

✅ Best Practice

expert

Handling Sensitive Variables in GitLab CI for Terraform

What is the best practice to securely provide sensitive variables (like AWS credentials) to Terraform in GitLab CI pipelines?

A Hardcode sensitive variables directly in the .gitlab-ci.yml file.

B Store sensitive variables in GitLab CI protected variables and reference them in the pipeline.

C Commit sensitive variables in a separate encrypted file in the repository.

D Pass sensitive variables as plain text environment variables in pipeline scripts.

💡 Hint

Think about GitLab features designed for secrets management.

GitLab CI protected variables securely store secrets and inject them into pipelines without exposing them in code or logs.