Describe the Terraform workflow from code to live

WHAT THIS TESTS: Whether you understand that team-based Terraform is not just local CLI commands but a structured workflow involving version control, remote execution, policy enforcement, and state management. Interviewers want to see you know the difference between a solo developer running commands on a laptop and a production-grade pipeline that uses HCP Terraform or similar remote backends for collaboration.

A GOOD ANSWER COVERS: First, write and commit configuration changes to version control so the code is reviewable. Second, authenticate to the remote environment, for example with terraform login for HCP Terraform. Third, run terraform plan to start a speculative plan that executes remotely using workspace variables and enforces any applicable Sentinel or OPA policies without copying sensitive values locally. Fourth, after review, execute terraform apply to start a standard plan and apply in the remote workspace, or use a two-part saved plan run with terraform plan -out FILE followed by terraform apply FILE to ensure the exact approved plan is what gets deployed. Fifth, verify the run completed and outputs are correct. The answer should mention that remote runs use the private registry and remote state inputs, and that this CLI-driven workflow can integrate with existing CI/CD pipelines.

COMMON WRONG ANSWERS: Describing only a local workflow where the developer runs terraform init, plan, and apply on their own machine with local state. Forgetting to mention code review or version control. Saying terraform apply runs immediately without a plan phase in remote workflows. Claiming that speculative plans modify infrastructure. Not mentioning policy enforcement, workspace variables, or state locking. Confusing the CLI-driven workflow with purely local execution.

LIKELY FOLLOW-UPS: How would you handle a failed apply or partial state? When would you use a saved plan run versus a standard remote apply? How do you manage secrets and sensitive variables in a team setting? What is the difference between UI/VCS-driven runs and CLI-driven runs? How do you roll back a Terraform change?

ONE CONCRETE EXAMPLE: A developer needs to add an AWS subnet. They branch, edit the Terraform configuration, and open a pull request. After peer review, they run terraform plan from their local terminal which triggers a speculative plan in HCP Terraform. The plan shows the subnet and passes Sentinel policy checks. Because the workspace has no linked VCS repository, they then run terraform apply to execute a standard remote plan and apply. The run executes in HCP Terraform using workspace variables and remote state, locks the state during the operation, and creates the subnet. The developer verifies the new resource in the AWS console.

Source: developer.hashicorp.com