Interview › Infrastructure as Code (Terraform, Ansible)
What is a remote state data source, and what is the security concern with it?
Infrastructure as Code (Terraform, Ansible) · Intermediate level
Answer
A remote state data source reads outputs from another Terraform state. It is convenient for cross-stack integration, but the security concern is that state often contains sensitive data and the reader may gain access to more than the intended outputs. I prefer narrower interfaces such as SSM Parameter Store, Secrets Manager, or explicitly published outputs when possible.
Technical explanation
Remote state coupling can make refactors hard because consumers depend on another workspace's output names.
State access often grants more data than one output, so apply least privilege carefully.
A safer pattern is to publish only required IDs to a controlled service catalog or parameter store.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Create a producer workspace that outputs a VPC ID and a consumer that reads it.
2. Example consumer:
data "terraform_remote_state" "network" {
backend = "s3"
config = { bucket = "company-tfstate-prod" key = "network/prod.tfstate" region = "ap-south-1" }
}
module "app" {
source = "../../modules/app"
vpc_id = data.terraform_remote_state.network.outputs.vpc_id
}
3. Review who can read the entire referenced state, not only vpc_id.
4. Replace the remote state dependency with SSM Parameter Store or a service catalog entry if access is too broad.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?