A new team member ran `terraform apply` in the dev environment and accidentally modified the shared VPC used by all environments. Which practice would have prevented this?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Separating environments into distinct Terraform workspaces or state files with least-privilege IAM roles per environment

Isolating environments into separate state files (or workspaces) with environment-specific IAM roles ensures a dev engineer cannot modify prod or shared resources. `prevent_destroy...

Real Exam Scenario

A new team member ran `terraform apply` in the dev environment and accidentally modified the shared VPC used by all environments. Which practice would have prevented this?

✓ Correct Answer & Explanation

Correct Answer

Separating environments into distinct Terraform workspaces or state files with least-privilege IAM roles per environment

Why This Answer Is Correct

Isolating environments into separate state files (or workspaces) with environment-specific IAM roles ensures a dev engineer cannot modify prod or shared resources. `prevent_destroy` guards against deletion but not modification. `terraform validate` only checks syntax. Provider pinning ensures consistent behavior but doesn't restrict access scope.