A team uses a Terraform configuration that creates an AWS S3 bucket and then applies a bucket policy that grants access to a specific IAM role. The policy references the role's ARN, which is passed as a variable. The team wants to ensure that the role exists before the bucket policy is created, and if it does not, the plan should fail with a clear message. Which approach should they use?

Add a `precondition` block to the `aws_s3_bucket_policy` resource that checks whether the IAM role data source returns a valid ARN.

Add a `validation` block to the `aws_s3_bucket_policy` resource that checks the role ARN.

Use a `count` on the `aws_s3_bucket_policy` resource that is set to 0 if the role does not exist.

Add a `postcondition` block to the `aws_s3_bucket_policy` resource that checks the role ARN after the policy is applied.

What is the purpose of the error_message argument in a validation block?

To display a clear message to the user when the validation condition fails

To log the validation result to a file

To provide a description of the variable for documentation

To specify the severity of the validation error

Where can precondition and postcondition blocks be placed in Terraform configuration?

On resources, data sources, and outputs

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 2Objective 1

2a TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Develop and troubleshoot dynamic configuration domain, which makes up ~20% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 3–5 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

6concepts

Questions 6–10

6foundation · easy
In an output postcondition, what keyword refers to the output's computed value?
Select an answer first
7application · medium
A team uses a Terraform configuration that creates an AWS S3 bucket and then applies a bucket policy that grants access to a specific IAM role. The policy references the role's ARN, which is passed as a variable. The team wants to ensure that the role exists before the bucket policy is created, and if it does not, the plan should fail with a clear message. Which approach should they use?
Select an answer first
8foundation · easy
Which block type can be used to assert that a condition holds true before a resource is created or updated?
Select an answer first
9foundation · easy
What is the purpose of the error_message argument in a validation block?
Select an answer first
10foundation · easy
Where can precondition and postcondition blocks be placed in Terraform configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

2a TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

In an output postcondition, what keyword refers to the output's computed value?

Which block type can be used to assert that a condition holds true before a resource is created or updated?

What is the purpose of the error_message argument in a validation block?

Where can precondition and postcondition blocks be placed in Terraform configuration?

Keep studying — Develop and troubleshoot dynamic configuration