Terraform plan wants to destroy a production database that someone modified manually. What do you do?
What they are really testing: Judgement under pressure with a destructive plan on screen. They want to see that you stop, understand the diff, and never apply hoping it works out.
A real interview question
Terraform plan wants to destroy a production database that someone modified manually. What do you do?
What most people say
drag me
“I would run terraform apply since the code is the source of truth.”
This is how production databases get deleted. Code is the source of truth in principle, but reconciling that principle at apply time on a live database is data loss, and the correct sequence is to make code match intended reality first.
The follow-ups they ask next
How do you stop a destructive plan reaching apply at all?
Plan on the pull request with the output posted for review, require approval for any plan containing destroy, and use prevent_destroy on stateful resources so Terraform refuses outright.
When is manually changing production ever acceptable?
During a genuine incident where speed matters. The rule is you own reconciling it back into code immediately afterwards, and the incident review tracks that as an action item.
What the interviewer is listening for
- Refuses to apply and says why
- Distinguishes replace from delete
- Adds guardrails and process fixes, not just a one-off fix
What sinks the answer
- Applies because code is truth
- No import or reconcile plan
- Treats drift as purely a discipline problem
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I [do not apply, since that resolves the divergence by deleting data]. I [read whether it is a replace or a delete], then [update config to match intended reality, or import], until [plan shows no changes]. Then [prevent_destroy, deletion protection, remove console write access, nightly drift detection].”
Keep going with infrastructure as code
Foundation
What is infrastructure as code, and why is it better than clicking in a console?
Junior
What is Terraform state, why does it exist, and what goes wrong if two people apply at the same time?
Senior
How would you structure Terraform for 40 services across 3 environments? What goes wrong with the obvious approaches?
Mid
Our pipeline takes 45 minutes and developers have stopped waiting for it. How do you fix that?
Mid
A pod is in CrashLoopBackOff after a deploy. Walk me through your debugging, command by command.
Mid
You need to rename a heavily-used database column with zero downtime. How?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free