HashiCorp Terraform Associate

Every platform has two control planes. One is Kubernetes, and this site is mostly about that. The other built the accounts, the networks, the buckets and the cluster itself — and for most of the industry that is Terraform. The HashiCorp Certified: Terraform Associate says you can drive it: the workflow, the state file, providers, modules, and HashiCorp’s hosted service. It is cheap, short and multiple-choice, and — for the right reader, with a caveat we spend a whole section on — arguably the most transferable non-CNCF certificate a platform engineer can hold. For the wrong reader it is an hour of recall you already have. Here is the current 004 version, what happened to 003, exactly what the vendor publishes, and when to keep your money.

What this credential is and where it sits

☺ Like you’re 10: A short quiz from the company that makes Terraform, saying “yes, this person knows the basics.”

The HashiCorp Certified: Terraform Associate is a vendor certification from HashiCorp (now part of IBM), who created Terraform. It is a knowledge exam, not a lab: an hour of multiple-choice, true/false and multiple-answer questions, online with a live proctor. No cluster, no terminal, nothing to build. HashiCorp aims it at a “Cloud Engineer with foundational Terraform knowledge and skills” who can tell the community edition apart from the commercial one.

The HashiCorp ladder, as currently published

As of writing the official certifications hub lists four live credentials and only four: Terraform Associate (004), Terraform Authoring and Operations Professional, Vault Associate (003) and Vault Operations Professional. A Consul Associate exam existed in earlier years and no longer appears — if a course sells you a HashiCorp cert that is not one of those four, check the hub first. The Professional tier is a different animal: per the official page it is lab-based and multiple choice, four hours including a break, $295 USD plus taxes, with a free retake — and it still tests Terraform 1.6 while the Associate tests 1.12. Its Vault sibling has its own page.

Version 004 replaced 003

The exam is versioned with a three-digit code that also appears on your badge. The official Infrastructure Automation page now describes only 004 and carries a section headed “Content differences between the 003 and 004 exams” — the vendor’s own way of saying 003 is behind us. Third-party reporting of the changeover is consistent: 5 January 2026 was the last day to schedule 003, 7 January 2026 the last day to sit it, and 004 has been the only version since 8 January 2026. Treat those dates as reporting rather than as something the vendor still publishes; treat “003 is not the exam you can sit” as settled, because HashiCorp no longer lists it at all.

Why a platform engineer takes it — and when to skip it

☺ Like you’re 10: Great if you have never really used Terraform. A wasted weekend if you already use it daily.

The case for is strong. The layer under everything on this site — accounts, VPCs, IAM roles, the first management cluster — is usually built by Terraform. Our IaC & Control Planes lesson calls that the “run-to-completion” half of the world; learn only the Kubernetes half and you become the engineer who can compose a beautiful Crossplane API but cannot say why the bootstrap pipeline is stuck on a lock. At $70.50 plus tax it is the cheapest forcing function around for closing that gap properly rather than by copy-paste.

The honest case against

Three situations where you should not take it. You already write Terraform weekly — this is an associate-level knowledge test, and if you have shipped modules, split a state file and survived an import, it teaches you nothing your code does not already show; the lab-based Professional is the one with something left to prove. Your platform is Kubernetes-native — if provisioning runs through Crossplane and Cluster API and Terraform lives only in a bootstrap repo nobody touches, the CNPA or CNPE maps onto your real work and this does not. You are collecting badges — a multiple-choice cert is a hiring filter and a study scaffold, not evidence you can operate infrastructure, and a team that reads it that way is making a hiring mistake.

What it actually tests — the official objectives

☺ Like you’re 10: Eight numbered topics. The vendor does not say how many questions come from each.

This is the exam content list as HashiCorp publishes it for 004. HashiCorp does not publish percentage weights — unlike the CNCF exams there is no “25% GitOps” to plan around, so any blog offering weights invented them. The sub-objectives are your real revision checklist, and the official exam content list links each one to the doc page that answers it.

What changed in 004

HashiCorp lists four new topics: 4f — depends_on and the create_before_destroy lifecycle rule; 4g — validating configuration using custom conditions; 4h — ephemeral values and write-only arguments; and 8c — organising HCP Terraform workspaces and projects. The exam also moved up to Terraform 1.12 and leans harder on HCP Terraform throughout. If you study one new thing, make it 4h — it is the modern answer to “how do I stop secrets landing in state?”

The substance you actually need

☺ Like you’re 10: A few commands, one notebook, and building blocks with names. Learn the notebook best — that is where people get hurt.

The core workflow — domain 3, and free marks

The cheapest domain to lock down: know what each command reads, what it writes, and what it refuses to do.

terraform init                 # download providers + modules, configure the backend
terraform init -upgrade        # re-resolve provider versions within your constraints
terraform fmt -recursive       # canonical formatting (objective 3g)
terraform validate             # syntax + internal consistency — no cloud calls, no state
terraform plan -out=tfplan     # compute the diff and save it as an opaque binary plan
terraform apply tfplan         # apply exactly that plan — no re-prompt, no re-diff
terraform destroy              # plan + apply the removal of everything in this state

terraform state list                     # what does the notebook think exists?
terraform state show aws_instance.web    # every recorded attribute of one resource
terraform show -json tfplan              # machine-readable plan — feed it to policy
terraform output -raw db_endpoint        # read an output value
TF_LOG=DEBUG terraform apply             # verbose logging (7c); TRACE is louder still

Three details the exam likes: validate does not call a provider API or need credentials, so it runs happily in CI on a pull request; a saved plan file applies without re-prompting, which is what makes an approval gate meaningful; and TF_LOG accepts TRACE, DEBUG, INFO, WARN or ERROR in decreasing verbosity — plus JSON, which emits TRACE-level output in a parseable encoding — with TF_LOG_PATH to append it to a file. TF_LOG_PATH on its own does nothing: you must set TF_LOG as well.

Configuration — providers, variables, modules, conditions

Domains 2, 4 and 5 are one continuous idea: describe things, parameterise them, package them.

terraform {
  required_version = ">= 1.12.0"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }   # pessimistic constraint
  }
  backend "s3" {                       # domain 6: remote state
    bucket       = "acme-tfstate"
    key          = "platform/prod/terraform.tfstate"
    region       = "eu-west-1"
    encrypt      = true
    use_lockfile = true                # S3-native state locking
  }
}

variable "instance_count" {
  type    = number
  default = 2
  validation {                          # objective 4g: custom condition
    condition     = var.instance_count > 0 && var.instance_count <= 10
    error_message = "instance_count must be between 1 and 10."
  }
}

data "aws_ami" "base" {                 # data block: read, never create
  most_recent = true
  owners      = ["amazon"]
}

resource "aws_instance" "web" {
  count         = var.instance_count    # meta-argument; for_each is the keyed alternative
  ami           = data.aws_ami.base.id  # cross-resource reference => implicit dependency
  instance_type = "t3.small"
  tags          = { Name = "web-${count.index}" }

  depends_on = [aws_iam_role_policy.web] # 4f: explicit dep (policy declared elsewhere)
  lifecycle {
    create_before_destroy = true         # objective 4f: build the new one first
    precondition {                       # objective 4g
      condition     = data.aws_ami.base.architecture == "x86_64"
      error_message = "Base AMI must be x86_64."
    }
  }
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"   # registry source
  version = "~> 5.0"                          # objective 5d: pin module versions
  name    = "platform-prod"
}

output "web_ips" {
  value     = aws_instance.web[*].private_ip   # splat expression
  sensitive = false
}

Memorise rather than derive under time pressure: count gives a list indexed by position (reordering causes churn) while for_each gives a map keyed by a stable string; referencing another resource’s attribute creates an implicit dependency, and depends_on is the escape hatch for hidden ones; the version argument is supported only for modules installed from a registry, public or private — Git, HTTP and local-path sources have no version argument at all and are pinned with a ref in the source string, as in source = "git::https://example.com/vpc.git?ref=v1.2.0"; and variable precedence runs the default in the variable block → TF_VAR_ environment variable → terraform.tfvars → terraform.tfvars.json → *.auto.tfvars files in lexical order → -var and -var-file on the command line, last one winning.

State — the domain that fails people

Four facts carry domain 6. The default is a local terraform.tfstate, fine for one person and a disaster for a team, so real platforms use a remote backend. State locking stops two concurrent applies corrupting it, and -lock=false is a footgun, not a fix. State holds sensitive values in plaintext, including generated passwords — hence encryption, access control, and the 004-era answer of ephemeral values and write-only arguments plus a real secret store (Secrets Management, External Secrets). And drift is only discovered when you next run a plan: that is the run-to-completion bargain.

# Adopt something that already exists (objective 7a)
terraform import aws_s3_bucket.logs acme-prod-logs
# ...or declare an import block in your config and let Terraform draft the resource:
#   import {
#     to = aws_s3_bucket.logs
#     id = "acme-prod-logs"
#   }
terraform plan -generate-config-out=generated.tf   # writes config you review, then apply

# Rename or move WITHOUT destroy/recreate — prefer a moved block in code:
#   moved {
#     from = aws_instance.app
#     to   = aws_instance.web
#   }
terraform state mv aws_instance.app aws_instance.web

# Stop managing something without deleting it in the cloud
terraform state rm aws_s3_bucket.legacy

# CLI workspaces: multiple state files, ONE backend, ONE configuration
terraform workspace new staging
terraform workspace select default

HCP Terraform — domain 8, and do not skip it

Self-taught candidates lose points here, because you can run Terraform for years from a laptop and never touch the hosted product. Know that HCP Terraform (formerly Terraform Cloud) gives you remote state with locking, remote runs with a plan/apply approval gate, variable sets, VCS-driven workflows, private module registries, run tasks, and policy as code via Sentinel or OPA — the instinct we cover in Governance & Compliance and OPA Gatekeeper. There is a free tier; an afternoon in it beats any set of practice questions.

How it maps onto this site

☺ Like you’re 10: Nearly every topic on the quiz is already a page here, wearing a different hat.

One gap worth naming: this exam has no lab component, so nothing on it proves you can build. The nearest hands-on equivalents here are the architecture lab and the architecture practice tasks — do those alongside, not instead of, the reading.

Run-to-completion vs continuous reconciliation

This is the connection worth carrying into the job. Terraform is run-to-completion: you invoke it, it converges the world, it exits, and between runs nothing is watching. Crossplane and Cluster API are continuously reconciling control planes — a controller holds desired state forever, which is the GitOps loop pointed at cloud resources instead of Deployments. Delete a Terraform-built bucket by hand and it stays deleted until someone runs a plan; delete a Crossplane-managed one and it returns on its own. Neither is better — they trade blast radius and provider breadth against latency of repair — and grown-up platforms run both: Terraform for the foundation and the bootstrap, control planes for the self-service surface and the fleet.

OpenTofu — what the fork means for your team

In August 2023 HashiCorp relicensed Terraform from MPL 2.0 to the source-available BUSL 1.1; the community forked the last MPL version as OpenTofu, a Linux Foundation project that was accepted into the CNCF at Sandbox maturity on 23 April 2025. The fork is licence-driven, not technology-driven: the tofu CLI mirrors terraform, HCL and providers and the state model are shared, and OpenTofu has grown features of its own such as native state encryption. For a candidate, domains 1–7 transfer almost entirely and domain 8 does not, because HCP Terraform is HashiCorp’s commercial product. Running OpenTofu means studying one vendor-specific domain out of eight for a credential the market recognises — a defensible trade, made consciously. See the CNCF Landscape for the neighbours.

Exam logistics — verify before you book

☺ Like you’re 10: One hour, online, someone watches on camera, about seventy dollars, good for two years.

All of this comes from the official Infrastructure Automation certifications page as of writing. Prices exclude local taxes and change quietly — confirm at checkout.

Registration runs through the HashiCorp certification portal behind a sign-in, which is also where the current proctoring vendor, ID requirements and accommodations process live — read that flow rather than a blog’s description of it. Official prep sits at the 004 prep hub: a learning path, the exam content list, and sample questions. Those three plus a free HCP Terraform account are genuinely enough.

Verdict — where it fits in a realistic order

☺ Like you’re 10: Take it early if you are new, skip it if you do this daily, and never let it replace the hands-on exams.

For a platform engineer building toward the CNPE, a defensible sequence: get comfortable with Kubernetes first, because everything else here assumes it; take the Terraform Associate early as a cheap, fast way to make the cloud-provisioning half of your brain rigorous; then spend real effort and money on the performance-based CNPE, which proves you can build rather than recall. Be honest about the asymmetry: the CNPE is $445 and far harder, so “the same effort” is really six times the money. This is a good first or second credential and a poor final one. And if the gap you are closing is provider-shaped rather than tool-shaped — IAM, networking, managed services — a cloud track such as AWS DevOps, Azure DevOps or Google Cloud DevOps covers that ground more directly than any Terraform exam will.

Two calibrations to close on. It is an hour of multiple choice — treat it as a structured reading list with a badge attached, not as a qualification. And the badge expires in two years while the code keeps moving: 001 became 002 became 003 became 004, with no reason to expect that to stop. Learn the concepts, which are permanent; rent the badge, which is not.

Next stop: the credential hub, where this sits alongside the rest of the beyond-CNCF options — Certifications.