Skip to content
RED SAGSkills
mediumCloud Engineer interview question

Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.

What the interviewer wants to hear

  • Run fmt, validate, linting and security scanning on every pull request
  • Post terraform plan output to the pull request for review
  • Apply the reviewed plan after merge, with remote state and locking
  • Promote through environments with approvals for production
  • Use OIDC short-lived credentials and separate roles per environment
  • Scheduled drift detection

Model answer

On every pull request the pipeline runs terraform fmt -check, validate, tflint and a security scanner such as Checkov or Trivy, then runs plan for each affected environment and posts the plan to the pull request. Reviewers approve the code and the plan together. After merge, the pipeline applies to dev automatically, then staging, and production waits for a manual approval through a protected GitHub environment. I save the plan file and apply exactly that plan so nothing changes between review and apply. State lives in a remote backend with locking, separate per environment. The pipeline authenticates to the cloud with OIDC, assuming a different least-privilege role per environment, so there are no long-lived keys. Finally, a nightly job runs plan against each environment and alerts if it finds drift.

Can you answer it under time pressure?

Take a timed medium round and get scored on every answer.

Start mock interview

More medium Cloud Engineer questions