Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why split an EKS stack into several layers with separate state?

   1. ATerraform can't handle large files
   2. BSmaller blast radius per apply, faster plans, clear ownership, and it solves the provider chicken-and-egg (cluster before Kubernetes resources)
   3. CIt's required by AWS
   4. DTo avoid using modules
   Show answer

   B. A change to a Helm chart shouldn't be able to replace the VPC. Layers keep each plan small and each state focused.

   From lesson 01 · Repo layout & run order

2. Q2. Where should environment differences (sizes, CIDRs, versions) live?

   1. ACopied code per environment
   2. BAs inputs (tfvars) to the same versioned modules
   3. CIn the provider block
   4. DIn comments
   Show answer

   B. Same code, different inputs keeps environments consistent; promotions become input changes, reviewed like code.

   From lesson 01 · Repo layout & run order

3. Q3. What does committing .terraform.lock.hcl give you?

   1. AFaster applies
   2. BEveryone and every pipeline uses the exact same provider versions and checksums
   3. CState locking
   4. DEncrypted state
   Show answer

   B. The dependency lock file pins provider versions and hashes, so a new provider release can't change a plan unexpectedly.

   From lesson 01 · Repo layout & run order

4. Q4. Why keep Terraform state in S3 rather than on a laptop?

   1. AIt's faster
   2. BShared, durable, versioned and encrypted state that the whole team and CI use, with locking to prevent concurrent applies
   3. CLaptops can't run Terraform
   4. DS3 is free
   Show answer

   B. Local state can't be shared safely and is easily lost. Remote state with locking is the basis of team workflows.

   From lesson 02 · Remote state: S3, locking, env-per-tfvars

5. Q5. What does state locking prevent?

   1. AReading state
   2. BTwo applies modifying the same state at the same time and corrupting it or racing on resources
   3. CPlans
   4. DEncryption
   Show answer

   B. The lock (an S3 lock file in newer Terraform, or a DynamoDB item in older setups) makes the second run wait or fail.

   From lesson 02 · Remote state: S3, locking, env-per-tfvars

6. Q6. What does exit code 2 from 'terraform plan -detailed-exitcode' mean?

   1. AAn error
   2. BThe plan succeeded and there are changes: something differs from the code (drift or pending changes)
   3. CNo changes
   4. DLocking failed
   Show answer

   B. Nightly jobs use it to detect drift: 0 means in sync, 2 means something changed outside (or inside) Terraform.

   From lesson 02 · Remote state: S3, locking, env-per-tfvars

7. Q7. Why can a single Terraform stack that creates EKS and installs Helm charts fail on the first plan?

   1. AHelm is incompatible
   2. BThe Kubernetes/Helm providers need the cluster endpoint and credentials, which don't exist until the cluster is created
   3. CTerraform can't use two providers
   4. DEKS blocks Helm
   Show answer

   B. Providers are configured before resources are applied. If their configuration depends on resources not yet created, planning can fail or behave unpredictably.

   From lesson 03 · The multi-provider chicken-and-egg

8. Q8. Why prefer an exec block ('aws eks get-token') over a token from the aws_eks_cluster_auth data source?

   1. AIt's shorter
   2. BThe data source's token is fetched once at plan time and expires after about 15 minutes, breaking long applies; exec fetches a fresh token when needed
   3. Cexec is required by EKS
   4. DData sources are deprecated
   Show answer

   B. Long applies (node groups, Helm charts with waits) can outlive a pre-fetched token. Exec authentication avoids that.

   From lesson 03 · The multi-provider chicken-and-egg

9. Q9. What's the most robust structure for cluster + platform components?

   1. AOne huge stack
   2. BSeparate stacks: the cluster layer first, then a platform layer that reads the cluster's outputs via remote state
   3. COnly Helm, no Terraform
   4. DOnly kubectl
   Show answer

   B. Layering removes the dependency at plan time, reduces blast radius, and lets the layers change at different speeds.

   From lesson 03 · The multi-provider chicken-and-egg