Terraform Associate Certification Guide

Terraform Associate validates your ability to use HashiCorp Terraform for Infrastructure as Code (IaC). It's the fastest-growing DevOps certification and essential for cloud provisioning across AWS, Azure, GCP, and on-premises.

Exam Overview

Detail	Value
Exam Code	003
Provider	HashiCorp
Questions	57 (multiple choice)
Length	60 minutes
Passing Score	~70%
Price	~$70 USD (plus free retake)
Recertification	None — does not expire

Domain Breakdown

Domain	Weight
Infrastructure as Code (IaC) Concepts	14%
Understand Terraform's Purpose	16%
Use the Terraform CLI (Outside of Core Workflow)	16%
Interact with Terraform Modules	12%
Navigate Terraform Core Workflow	44%

Key Concepts

Infrastructure as Code (14%)

What is IaC? — Managing infrastructure (servers, networks, databases) through machine-readable definition files
Declarative vs Imperative — Terraform is declarative (desired state) vs Ansible/Chef (procedural)
Idempotency — Running the same configuration multiple times produces the same result
Mutable vs Immutable Infrastructure — Terraform promotes immutable (recreate instead of modify)
Configuration Management vs Provisioning — Terraform provisions (creates infrastructure); tools like Ansible/Puppet configure (install software)

Terraform's Purpose (16%)

Terraform vs competitors — CloudFormation (AWS-only), ARM (Azure-only), Pulumi (programming languages)
Provider Ecosystem — AWS, Azure, GCP, Kubernetes, GitHub, etc. — 2000+ providers
Terraform Cloud / Enterprise — Remote state, runs, teams, sentinel policies, workspace management
Multi-Cloud — Terraform's key differentiator: manage all clouds with one tool/language
Terraform vs Terragrunt — Terragrunt is a wrapper reducing configuration duplication

Terraform CLI (16%)

terraform init — Initialize working directory, download providers, configure backend
terraform validate — Check configuration syntax and internal consistency
terraform fmt — Format code to canonical style (HCL)
terraform plan — Create execution plan (what will be created, modified, destroyed)
terraform apply — Execute the plan (with or without approval)
terraform destroy — Destroy all resources defined in configuration
terraform state — State management commands (list, show, mv, rm, pull, push)
terraform import — Import existing infrastructure into Terraform state
terraform output — Display output variables
terraform graph — Generate dependency graph (DOT format)
terraform taint — Mark resource for recreation (deprecated in favor of -replace)

Terraform Modules (12%)

Module Structure — Root module vs child modules, module sources (local, registry, Git, S3)
Terraform Registry — Public or private module registry, version constraints
Module Composition — Calling modules, passing variables, exposing outputs
Module Versioning — Semantic versioning, version constraints (>, >=, <, <=, ~>, !=)
Best Practices — Small focused modules, standard structure (main.tf, variables.tf, outputs.tf)

Core Workflow (44%)

This is the largest domain. Master these concepts:

HCL (HashiCorp Configuration Language)

Resource Blocks — resource "aws_instance" "web" { ... }
Data Sources — data "aws_ami" "ubuntu" { ... } — Query existing infrastructure
Variables — Input variables, output values, local values
Expressions — Conditionals, for expressions, splat expressions, string templates
Functions — Numeric (max, min), string (upper, lower, format), collection (length, lookup, merge), file, templatefile

State Management

Local State — terraform.tfstate file (default)
Remote State — S3, Terraform Cloud, Azure Storage, GCS, Consul
State Locking — Prevents concurrent modifications (DynamoDB for S3 backend)
Sensitive Data — State may contain secrets; use remote state with encryption
Workspaces — Named state files for managing environments (dev/staging/prod)

Dependency Management

Explicit Dependencies — depends_on meta-argument
Implicit Dependencies — Automatically detected via references
Resource Graph — Terraform builds a dependency graph; parallelizes where possible

Provisioners

file — Copy files to remote resource
remote-exec — Run commands on remote resource inline
local-exec — Run commands on local machine
⚠️ Provisioners are last resort — Better to use user_data, custom images (Packer)

Lifecycle Rules

create_before_destroy — Create new resource before destroying old (reduces downtime)
prevent_destroy — Prevents accidental deletion of critical resources
ignore_changes — Ignore attribute changes (e.g., tags)
replace_triggered_by — Replace resource when another resource changes

Error Handling

precondition / postcondition blocks — Validate before/after resource creation
Plan review — Always review terraform plan output before apply

Core Workflow Cycle

Write → Init → Plan → Apply → (Repeat)

Write — Define infrastructure in .tf files
Init — terraform init (first time or when providers/backends change)
Plan — terraform plan (verify changes)
Apply — terraform apply (execute changes)
Destroy — terraform destroy (tear down)

Exam Tips

Understand the order of precedence for variables — CLI flags > .tfvars files > environment variables > defaults
Know backend types — S3 (with DynamoDB locking), Terraform Cloud, Consul, remote
Master state commands — terraform state list, terraform state show, terraform state mv
Understand terraform import — Write config first, then import existing resources
Know module sources — Terraform Registry, GitHub, Bitbucket, Git, HTTP, S3/GCS buckets
Recognize terraform plan output symbols — + create, - destroy, ~ modify, -/+ replace

Sample HCL Snippet

# provider.tf
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
  }
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/network/terraform.tfstate"
    region         = "eu-west-1"
    dynamodb_table = "terraform-locks"
  }
}

# main.tf
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  tags = {
    Name  = "web-server"
    Env   = terraform.workspace
  }
}

# variables.tf
variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"

  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium"], var.instance_type)
    error_message = "Must be a valid t3 instance type."
  }
}

# outputs.tf
output "instance_ip" {
  value       = aws_instance.web.public_ip
  description = "The public IP of the web server"
}

Practice Questions

Test your knowledge with our Terraform Associate practice questions — 50+ questions covering all exam domains.

Start Practice →

Career Impact

Terraform skills are in high demand for DevOps and cloud roles:

DevOps Engineer — $110k–$150k
Cloud Engineer — $100k–$140k
Site Reliability Engineer — $120k–$160k
Platform Engineer — $110k–$150k

Next: Terraform Advanced or combine with CKA for a complete IaC+containers skillset

HashiCorp Terraform Associate Exam Guide (003)