Cloud Engineer interview question
How do you manage cloud infrastructure as code?
Manage cloud resources through reviewed, versioned modules with pinned providers, remote locked state, policy and security checks, reusable environment composition, drift detection, and staged plans for destructive changes.
Direct answer
What a strong answer covers
How it works
Cloud resources are created only through reviewed code. Modules are versioned and pinned along with providers, so an apply today matches an apply next month. State lives in a remote backend with locking and restricted access. Every change produces a plan that a reviewer reads, and policy checks such as no public storage, mandatory tags, and encryption on volumes run automatically before apply. Environments are composed from the same modules with different variables rather than copied. Drift detection compares the cloud against the code on a schedule, and destructive changes such as replacing a database are staged with explicit approval and a backup taken first.
Example
A landing zone repository defines accounts, networking, and guardrails; each product team has an environment repository composing shared modules for its services. CI runs terraform plan on pull requests with tfsec and Sentinel policies, posts the plan as a comment, and applies on merge through a pipeline identity. A nightly drift job found a security group rule added by hand during an incident and opened a pull request to either codify or remove it.
Common mistakes
- Making changes in the console and hoping to codify them later.
- Running apply without a reviewed plan.
- Letting a rename in a module plan the destruction of a production database without anyone noticing.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.