How do you manage Terraform state and multiple environments (dev, staging, prod) safely?
What the interviewer wants to hear
- Remote backend with locking, versioning and encryption
- Separate state per environment and per component to limit blast radius
- Reusable modules with environment-specific variables
- Plan in CI on pull requests, apply with approval
- Restrict access to state since it may contain secrets; handle drift
Model answer
I always use a remote backend, for example an S3 bucket with versioning, encryption and native state locking, or Azure Blob or GCS. Each environment gets its own state, and often its own cloud account, so a mistake in dev cannot touch prod. I also split large systems into smaller states such as network, data and app, which keeps plans fast and limits the blast radius. Shared logic lives in versioned modules, and each environment has a thin root configuration with its own variables. Some teams use workspaces, but I prefer separate directories or a tool like Terragrunt for clearer separation. Changes go through pull requests where CI runs plan and posts the output, and apply runs only after approval, ideally from the pipeline using OIDC credentials. State can contain secrets, so access is tightly restricted. I also run scheduled plans to detect drift.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cloud Engineer questions
- Design a secure three-tier web application on AWS (or your preferred cloud). Walk through the network and services.
- A team stores customer documents in an S3 bucket. How would you secure it?
- An instance in a private subnet cannot reach the internet to install packages. How do you troubleshoot it?
- How would you plan the migration of an on-premises application to the cloud?
- Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.
- A team wants to move a service onto your Kubernetes cluster. What do you check before calling it production ready?
- You are on call and p99 latency for a cloud API jumps from 200 ms to 3 seconds. Walk through how you investigate and handle it.
- How do you manage application secrets such as database passwords and API keys in a cloud environment?
- Design a tagging and cost allocation strategy for a company running many teams on AWS.