Lesson 18 · Senior IaC judgment
Senior IaC interview questions
High-signal questions about Terraform truthfulness, state realism, module/API design, keyless trust paths, and infrastructure-change safety — with answer shapes that sound like real operational experience.
Your win: answer senior IaC questions with mechanism + trade-off + repo-grounded consequence, not just tool vocabulary or certification-style definitions.
Why these questions feel different from the base course
The base course taught Terraform fundamentals, state, modules, Terragrunt, Workload Identity, KMS, and Atlantis. This page asks a harder question: can you explain those topics honestly in the presence of the repo’s real operational posture?
The strongest answers here usually do three things: name the mechanism, name the trade-off or limit, and connect it to a concrete repo consequence. That answer structure is what makes a response sound like real experience instead of memorized terminology.
That is why this page should not be read like a glossary. It should be used like a speaking drill. The point is not only to know the topics. The point is to sound like someone who has had to make decisions around them.
Question bank
| Question | Best answer shape |
|---|---|
| What does Terraform actually own in this repo? | It owns a large part of the cloud/platform foundation and trust wiring, but not every important operational dependency lives in this tree. |
| Why is “everything is IaC here” too vague? | Because the repo map itself names exceptions and neighboring systems that depend on Terraform without being fully managed by it. |
| Why is state a senior topic rather than just a beginner concept? | Because remote state, locking, drift, and partial-failure history determine whether plans are trustworthy and collaboration is safe. |
| How would you describe the real value and cost of Terragrunt here? | It keeps wiring DRY at scale, but also introduces indirection that changes discoverability and coupling. |
| What is the real cross-course payoff of Workload Identity? | It explains the keyless trust path behind pod auth and CI federation; the binding is Terraform, not magic. |
| Why is KMS more important than just “the encryption lesson”? | Because it backs real decryption and attestation paths the platform already depends on. |
| Why are Atlantis applies gated so heavily? | Because infrastructure blast radius is high, so plan review, approval, team boundaries, and locking are safety controls. |
| Why is Terraform rollback language tricky? | Because recovery may involve reconciliation, import, or re-application, not a simple app-style redeploy. |
| What should a senior IaC reviewer ask first? | What this change truly owns, what state assumptions it relies on, and what blast radius or trust-boundary risk it introduces. |
| What separates a senior IaC answer from a beginner one? | Senior answers add truthfulness, trade-offs, and operational consequences on top of tool knowledge. |
root.hcl, GCS state isolation, the Workload Identity binding behind the annotation, gh-action-pool, the KMS keyrings, Atlantis apply restrictions, and the explicit “not everything is Terraform-managed” caveat.Use the playbook and repo map together
The playbook compresses the judgment layer; the repo map gives you the concrete Terraform details that make answers sound real.
Check yourself (from memory)
Q1. A strong senior IaC answer usually includes…
Sources. Repo IaC map; curated official Terraform/Terragrunt/GCP/Atlantis resources.