Skip to content
RED SAGSkills
hardCloud Engineer interview question

Your company has hundreds of Terraform configurations owned by many teams. How do you structure modules, state and governance so it scales safely?

What the interviewer wants to hear

  • Versioned, reusable modules in a registry with clear interfaces
  • Small state files split by environment, region and component to limit blast radius
  • Remote state with locking, encryption and least-privilege access
  • Policy as code checks in CI such as OPA, Sentinel or Checkov
  • Pinned provider and module versions with automated upgrade PRs
  • Platform team ownership balanced with team self-service

Model answer

I separate reusable modules from live configurations. A platform team owns a set of opinionated modules, such as a VPC, an EKS cluster or a service bucket, published to a private registry with semantic versions, tests and changelogs. Product teams compose these in their own live repos. State is split into small units by account, environment, region and component, so one bad apply has a limited blast radius and plans stay fast; layers share data through outputs or data sources, not one giant state. Every backend is remote, encrypted and locked, with access limited to that pipeline role. In CI, policy as code with OPA, Sentinel or Checkov blocks things like public buckets or missing tags. Provider and module versions are pinned, and Renovate opens upgrade PRs so teams move forward regularly instead of falling years behind.

Can you answer it under time pressure?

Take a timed hard round and get scored on every answer.

Start mock interview

More hard Cloud Engineer questions