Skip to content
Cheat sheets

004 · Domain 5: Terraform modules · 12% of the exam

Task 5.1: Explain how Terraform sources modules

Where module code comes from: local paths, the public and private registries, Git and other VCS addresses, HTTP archives and cloud storage, and what terraform init does with each.

Study it

  • Module sources: local paths, registries, Git, archives and object storage

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A team finds a module named "vpc" for the aws provider, published by the "terraform-aws-modules" namespace in the public Terraform Registry. Which source argument installs it?

  1. Asource = "aws/vpc/terraform-aws-modules"
  2. Bsource = "terraform-aws-modules/vpc/aws"
  3. Csource = "registry::terraform-aws-modules/vpc"
  4. Dsource = "https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws"
Show the answer and why

  • Asource = "aws/vpc/terraform-aws-modules"

    Incorrect

    The order is namespace, name, provider.

  • Bsource = "terraform-aws-modules/vpc/aws"

    Correct

    Public registry modules use the <NAMESPACE>/<NAME>/<PROVIDER> source format.

  • Csource = "registry::terraform-aws-modules/vpc"

    Incorrect

    There is no registry:: prefix, and the provider part is missing.

  • Dsource = "https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws"

    Incorrect

    Registry modules are addressed by namespace, name and provider, not by their web page URL.

Public registry addresses have three parts: namespace, module name and provider.

HashiCorp documentation

Task 5.1Report a problem with this question

Question 2 · choose 1

Where does Terraform put the code of remote modules that a configuration calls?

  1. AIn the state file, next to the resources
  2. BIn a hidden subdirectory, during terraform init
  3. CIn the settings of the HCP Terraform workspace
  4. DNowhere; Terraform reads remote modules over the network on every plan
Show the answer and why

  • AIn the state file, next to the resources

    Incorrect

    State stores bindings, not module code.

  • BIn a hidden subdirectory, during terraform init

    Correct

    Initializing installs the module by cloning its source into a hidden subdirectory of the working directory.

  • CIn the settings of the HCP Terraform workspace

    Incorrect

    Workspace settings hold run options and variables, not module code.

  • DNowhere; Terraform reads remote modules over the network on every plan

    Incorrect

    Modules are downloaded once and reused.

init downloads modules once into .terraform; plans use the local copy.

HashiCorp documentation

Task 5.1Report a problem with this question

Question 3 · choose 1

A public module lives at github.com/example-org/terraform-network. Which source form does Terraform recognize for GitHub without a git:: prefix?

  1. Agh:example-org/terraform-network?type=git
  2. Bexample-org/terraform-network/github
  3. Cgithub.com/example-org/terraform-network
  4. Dgithub::terraform-network
Show the answer and why

  • Agh:example-org/terraform-network?type=git

    Incorrect

    There is no gh: prefix.

  • Bexample-org/terraform-network/github

    Incorrect

    That looks like a registry address, not a GitHub URL.

  • Cgithub.com/example-org/terraform-network

    Correct

    Terraform recognizes unprefixed github.com URLs and clones them with Git.

  • Dgithub::terraform-network

    Incorrect

    There is no github:: prefix.

GitHub addresses are a shortcut for Git sources.

HashiCorp documentation

Task 5.1Report a problem with this question

Question 4 · choose 1

A private Git repository is reachable over SSH with the agent's key. Which form does the documentation recommend for the source URL?

  1. Agit::ssh://git@git.example.com/infra/network.git
  2. Bssh://git.example.com:infra/network
  3. Cgit::https://git.example.com/infra/network.git?ssh=true
  4. Dscp://git.example.com/infra/network.git
Show the answer and why

  • Agit::ssh://git@git.example.com/infra/network.git

    Correct

    The docs recommend the ssh://-prefixed URL for consistency, although an scp-like form also works.

  • Bssh://git.example.com:infra/network

    Incorrect

    Without git:: and a valid URL, Terraform cannot tell it is a Git source.

  • Cgit::https://git.example.com/infra/network.git?ssh=true

    Incorrect

    There is no ssh query parameter.

  • Dscp://git.example.com/infra/network.git

    Incorrect

    scp:// is not a module source scheme.

git:: plus an ssh:// URL is the clearest way to reach private Git modules.

HashiCorp documentation

Task 5.1Report a problem with this question

Question 5 · choose 1

A module source is git::https://git.example.com/infra/dns.git with no query parameters. What does Terraform install?

  1. AThe newest tag in the repository
  2. BNothing; a revision must always be given
  3. CEvery branch in the repository, letting the plan choose one per resource
  4. DThe default branch referenced by HEAD
Show the answer and why

  • AThe newest tag in the repository

    Incorrect

    Tags are not searched; the default branch is used.

  • BNothing; a revision must always be given

    Incorrect

    The default branch is used when no revision is given.

  • CEvery branch in the repository, letting the plan choose one per resource

    Incorrect

    One revision is checked out.

  • DThe default branch referenced by HEAD

    Correct

    For a Git source without extra parameters, Terraform clones and uses the default branch referenced by HEAD.

Without a pinned revision, the module changes whenever HEAD moves.

HashiCorp documentation

Task 5.1Report a problem with this question

Question 6 · choose 1

A vendor distributes a module as https://downloads.example.com/net.zip. Can Terraform use this URL as a module source?

  1. AYes; recognized archive URLs are downloaded and extracted
  2. BNo; HTTPS sources must be Git repositories
  3. CYes, but only through the private registry
  4. DNo; archives must be extracted into the root module's directory by hand first
Show the answer and why

  • AYes; recognized archive URLs are downloaded and extracted

    Correct

    When an HTTPS URL has a common archive extension, Terraform uses the archive's contents as the module source.

  • BNo; HTTPS sources must be Git repositories

    Incorrect

    Archives over HTTPS are supported.

  • CYes, but only through the private registry

    Incorrect

    The URL works directly as a source.

  • DNo; archives must be extracted into the root module's directory by hand first

    Incorrect

    Terraform extracts supported archives itself.

HTTP(S) archives are one of the many module source types.

HashiCorp documentation

Task 5.1Report a problem with this question

Practise domain 5 →Practise all domains →