Interview › Infrastructure as Code (Terraform, Ansible)
How do you handle resources changed manually outside Terraform?
Infrastructure as Code (Terraform, Ansible) · Basic level
Answer
For manual changes outside Terraform, I first run plan to understand the drift. Then I choose one of three actions: codify the intended change, revert the manual change, or update/import/remove state if ownership changed. I do not blindly apply until I know whether Terraform will undo or preserve the change.
Technical explanation
First classify the manual change as intended, accidental, or externally owned.
If intended, update code and apply; if accidental, let Terraform revert it; if ownership changed, update state and documentation.
The worst response is to use ignore_changes just to silence a plan without understanding the cause.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Set up drift handling for: How do you handle resources changed manually outside Terraform?
2. Schedule a read-only plan job per workspace:
terraform init
terraform plan -detailed-exitcode -out=drift.tfplan || status=$?
terraform show -json drift.tfplan > drift.json
3. Interpret exit code 0 as no drift, 2 as changes present, and 1 as an error requiring investigation.
4. For state-only synchronization, use refresh-only review:
terraform plan -refresh-only -out=refresh.tfplan
terraform apply refresh.tfplan
5. Open a ticket that classifies drift as revert, codify, ignore because externally owned, or remove from Terraform ownership.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?