Terraform_remote_state usage - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Terraform remote state data source

What does the terraform_remote_state data source in Terraform allow you to do?

A It creates a backup of the Terraform state file before every apply.

B It automatically synchronizes multiple Terraform state files into one.

C It allows you to access outputs from another Terraform configuration's state file.

D It encrypts the Terraform state file for security purposes.

💡 Hint

Think about how Terraform can share information between separate projects.

The terraform_remote_state data source lets one Terraform configuration read outputs from another configuration's state file, enabling resource sharing.

❓ Configuration

intermediate

Correct usage of terraform_remote_state with S3 backend

Which Terraform code snippet correctly configures terraform_remote_state to read from an S3 backend named prod-state in region us-west-2?

A

data "terraform_remote_state" "prod" {
  backend = "s3"
  bucket = "prod-state"
  region = "us-west-2"
}

B

data "terraform_remote_state" "prod" {
  backend = "s3"
  config = {
    bucket = "prod-state"
    region = "us-west-2"
  }
}

C

terraform_remote_state "prod" {
  backend = "s3"
  config = {
    bucket = "prod-state"
    region = "us-west-2"
  }
}

D

data "terraform_remote_state" "prod" {
  backend = "s3"
  config = {
    bucket = "prod-state"
    region = "us-east-1"
  }
}

💡 Hint

Remember the correct block type and where to put backend configuration.

The terraform_remote_state data source requires a data block with backend and config map specifying bucket and region. Region must match the actual bucket location.

❓ Architecture

advanced

Best practice for sharing remote state outputs securely

You have multiple Terraform projects that need to share outputs securely using terraform_remote_state. Which approach is best to ensure security and least privilege?

A Use separate S3 buckets for each project with bucket policies granting read access only to specific IAM roles used by consuming projects.

B Store all state files in a single S3 bucket with public read access and use <code>terraform_remote_state</code> to read outputs.

C Store state files locally on developer machines and share outputs via manual copy-paste.

D Use a single S3 bucket with no access restrictions and rely on Terraform to handle security.

💡 Hint

Think about controlling who can read state files and limiting exposure.

Using separate buckets with strict IAM policies limits access to only authorized projects, following least privilege and improving security.

❓ service_behavior

advanced

Effect of changing remote state backend configuration

What happens if you change the backend configuration of a terraform_remote_state data source from S3 to local without updating the actual state files?

A Terraform will ignore the backend change and continue reading from S3.

B Terraform will successfully read the remote state from the local path without errors.

C Terraform will automatically migrate the remote state from S3 to local backend.

D Terraform will raise an error because the local path does not contain the expected state file.

💡 Hint

Consider what happens if the backend points to a location without the expected state.

Changing backend to local requires the state file to exist locally. If it doesn't, Terraform errors because it cannot find the state.

❓ security

expert

Preventing sensitive data exposure in terraform_remote_state outputs

You want to use terraform_remote_state to share outputs but avoid exposing sensitive values like passwords. Which Terraform practice ensures sensitive outputs are not exposed?

A Mark sensitive outputs with <code>sensitive = true</code> in the producing module and avoid referencing them in consuming modules.

B Encrypt the entire state file manually before storing it in the backend.

C Store sensitive outputs in plain text but restrict access to the backend bucket.

D Use <code>terraform_remote_state</code> to read all outputs and filter sensitive ones in the consuming module.

💡 Hint

Think about Terraform's built-in way to mark outputs as sensitive.

Marking outputs as sensitive prevents Terraform from showing them in CLI or logs and discourages referencing them in other modules, reducing exposure risk.

Practice

1. What is the main purpose of using terraform_remote_state in Terraform?

easy

A. To create new resources in the cloud

B. To store Terraform state files locally on your machine

C. To safely share outputs from one Terraform project with another

D. To run Terraform commands faster

Solution

1. Step 1: Understand the role of terraform_remote_state

   The terraform_remote_state data source is used to access outputs from another Terraform state, enabling sharing data between projects.

2. Step 2: Differentiate from other Terraform functions

   It does not store state locally, create resources, or speed up commands; it only reads remote state outputs.

3. Final Answer:

   To safely share outputs from one Terraform project with another -> Option C

4. Quick Check:

   terraform_remote_state shares outputs safely [OK]

Hint: Remember: remote_state reads outputs from other projects [OK]

Common Mistakes:

• Thinking it stores state locally
• Confusing it with resource creation
• Assuming it speeds up Terraform commands

2. Which of the following is the correct syntax to declare a terraform_remote_state data source in Terraform?

easy

A. data "terraform_remote_state" "example" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } }

B. resource "terraform_remote_state" "example" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } }

C. variable "terraform_remote_state" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } }

D. output "terraform_remote_state" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } }

Solution

1. Step 1: Identify correct resource type for remote state

   The terraform_remote_state is declared as a data source, not a resource, variable, or output.

2. Step 2: Check syntax structure

   data "terraform_remote_state" "example" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } } correctly uses data "terraform_remote_state" "example" with backend and config blocks.

3. Final Answer:

   data "terraform_remote_state" "example" { backend = "s3" config = { bucket = "mybucket" key = "state.tfstate" region = "us-east-1" } } -> Option A

4. Quick Check:

   terraform_remote_state is a data source [OK]

Hint: Use 'data' block, not 'resource' for remote_state [OK]

Common Mistakes:

• Using resource instead of data
• Declaring as variable or output
• Missing backend or config blocks

3. Given this Terraform snippet accessing remote state outputs:

data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "net-state"
    key    = "network/terraform.tfstate"
    region = "us-west-2"
  }
}

output "vpc_id" {
  value = data.terraform_remote_state.network.outputs.vpc_id
}

What will be the output value of vpc_id if the remote state has vpc_id = "vpc-123abc"?

medium

A. null

B. "vpc-000000"

C. Error: output not found

D. "vpc-123abc"

Solution

1. Step 1: Understand remote state output access

   The code reads the remote state from S3 bucket and accesses the output named vpc_id.

2. Step 2: Match output value from remote state

   The remote state has vpc_id = "vpc-123abc", so the output will be exactly this string.

3. Final Answer:

   "vpc-123abc" -> Option D

4. Quick Check:

   Remote output vpc_id = "vpc-123abc" [OK]

Hint: Output matches remote state's output value exactly [OK]

Common Mistakes:

• Assuming output is null if not declared locally
• Confusing output with resource ID
• Expecting error if output exists remotely

4. You wrote this Terraform code to read remote state:

data "terraform_remote_state" "app" {
  backend = "s3"
  config = {
    bucket = "app-state"
    key    = "app/terraform.tfstate"
    region = "us-east-1"
  }
}

output "subnet_id" {
  value = data.terraform_remote_state.app.outputs.subnet_id
}

But Terraform shows error: Could not read state file. What is the most likely cause?

medium

A. The output name subnet_id is misspelled in the remote state

B. The S3 bucket or key does not exist or is inaccessible

C. You used resource block instead of data block

D. Terraform version is too old to support remote state

Solution

1. Step 1: Analyze error message

   "Could not read state file" usually means Terraform cannot find or access the remote state file in S3.

2. Step 2: Check configuration and permissions

   Verify the S3 bucket name, key path, and AWS permissions are correct and accessible.

3. Final Answer:

   The S3 bucket or key does not exist or is inaccessible -> Option B

4. Quick Check:

   State file access error means bucket/key issue [OK]

Hint: Check bucket/key existence and permissions first [OK]

Common Mistakes:

• Assuming output name typo causes state read error
• Confusing data block with resource block error
• Blaming Terraform version without checking config

5. You have two Terraform projects: network creates a VPC and outputs vpc_id. app needs to use that vpc_id. How should you configure app to use terraform_remote_state to get vpc_id from network stored in an S3 backend?

hard

A. In app, declare a data "terraform_remote_state" "network" block with backend "s3" and config matching network S3 bucket, key, and region, then access data.terraform_remote_state.network.outputs.vpc_id

B. In app, copy the vpc_id value manually from network outputs and hardcode it

C. In app, declare a resource "terraform_remote_state" "network" block with backend "s3" and config matching network

D. In app, use terraform_remote_state without specifying backend or config

Solution

1. Step 1: Understand cross-project state sharing

   To share outputs, app must declare a data "terraform_remote_state" block with backend and config matching network's S3 backend.

2. Step 2: Access the output properly

   Then app can access vpc_id via data.terraform_remote_state.network.outputs.vpc_id.

3. Final Answer:

   In app, declare a data "terraform_remote_state" "network" block with backend "s3" and config matching network S3 bucket, key, and region, then access data.terraform_remote_state.network.outputs.vpc_id -> Option A

4. Quick Check:

   Use data block with correct backend config to share outputs [OK]

Hint: Use data block with matching backend config to share outputs [OK]

Common Mistakes:

• Hardcoding output values instead of referencing remote state
• Using resource block instead of data block
• Omitting backend or config details