← Back to All Certifications

🏗️ HashiCorp Certified: Terraform Associate (003)

Your complete guide to earning the HashiCorp Certified: Terraform Associate (003) — the leading Infrastructure as Code credential, covering IaC concepts, HCL configuration, state management, modules, and Terraform Cloud for teams.

📅 2–3 Months Study
📝 57 Questions · 60 Minutes
🏆 Pass Score: 70%
⌨️ MCQ + Multi-Select + T/F
💰 $70.50 USD via Pearson VUE
🎯 Entry-to-Intermediate Level | DevOps Engineer / Platform Engineer / Cloud Architect / SRE

What is the Terraform Associate Certification?

The HashiCorp Certified: Terraform Associate (003) is the leading Infrastructure as Code (IaC) certification for cloud engineers and DevOps practitioners. It validates your ability to use Terraform for provisioning, managing, and automating cloud infrastructure across AWS, Azure, GCP, and hundreds of other providers. The exam covers the full Terraform workflow — from HCL configuration authoring and state management to modules, workspaces, and collaboration through Terraform Cloud. The 003 update (from 002) emphasizes Terraform Cloud features, the cloud block, moved block, check blocks, precondition/postcondition lifecycle, and the terraform test framework introduced in Terraform 1.6+.

📋 Recommended Prerequisites

🗺️ Certification Pathway

Cloud Fundamentals (AWS/Azure/GCP)
→
Terraform Associate 003
→
Terraform Professional (coming)
→
Vault Associate
→
Cloud Professional Certs
Exam Blueprint
Terraform Associate 003 — 9 Exam Domains
57 questions · 60 minutes · 70% passing score · Pearson VUE proctored
Domain 1: Understand Infrastructure as Code (IaC) Concepts ~15%
  • IaC benefits: consistency, automation, version control, documentation, auditability
  • Declarative vs. imperative IaC approaches and when each is appropriate
  • Terraform's declarative model and idempotency characteristics
  • Terraform vs. configuration management tools (Ansible, Chef, Puppet)
  • Terraform vs. container orchestration (Kubernetes), provisioning scope
Domain 2: Understand Terraform's Purpose ~9%
  • Multi-cloud and multi-provider Terraform use cases
  • The Terraform provider ecosystem (official, partner, community tiers)
  • How Terraform interacts with cloud APIs via providers
  • Terraform's place in the broader DevOps toolchain
Domain 3: Understand Terraform Basics ~9%
  • required_providers block — source, version constraints (~>, >=, =, !=)
  • .terraform.lock.hcl — why it exists, when to commit, how to update
  • Provider configuration — credentials, region, aliases for multi-region
  • Terraform Registry — module and provider discovery
  • required_version constraint enforcement
Domain 4: Use Terraform Outside the Core Workflow ~9%
  • terraform import — bringing existing resources under Terraform management
  • terraform state commands — list, show, mv, rm, pull, push, force-unlock
  • terraform console — interactive expression evaluation and function testing
  • terraform graph — dependency visualization as DOT format
  • apply -replace (replacement for deprecated taint command)
  • moved block for declarative refactoring of resource addresses
Domain 5: Interact with Terraform Modules ~12%
  • Module structure: main.tf, variables.tf, outputs.tf, versions.tf, README.md
  • Module source types: local, registry, GitHub, generic Git, S3, GCS
  • Version constraints for modules — why, how, semantic versioning
  • Module inputs (variables) and outputs — passing data between modules
  • path.module vs path.root — file references within modules
  • Registry naming convention: terraform-{provider}-{name}
Domain 6: Navigate Terraform Workflow ~20%
  • terraform init — providers, modules, backend configuration
  • terraform plan — plan symbols (+, -, ~, -/+), saved plan files (-out)
  • terraform apply — confirmation, auto-approve, applying saved plan
  • terraform destroy and apply -destroy equivalence
  • terraform fmt — canonical formatting, -check for CI validation
  • terraform validate — syntax and configuration logic checking
  • terraform output — reading module and root outputs
Domain 7: Implement and Maintain State ~9%
  • Remote backends: S3+DynamoDB, Azure Blob, GCS, Terraform Cloud
  • State locking — purpose, DynamoDB table requirements, force-unlock
  • Partial backend configuration for secrets management
  • terraform_remote_state data source — inter-configuration dependencies
  • Drift detection via terraform plan and remediation via apply
  • State sensitivity — state file contains secrets in plain text
Domain 8: Read, Generate, and Modify Configuration ~9%
  • Variables: types, validation blocks, sensitive flag, precedence order
  • Locals: complex computed values, DRY configuration
  • Data sources: reading existing infrastructure, data.TYPE.NAME.attribute
  • count vs for_each — tradeoffs, address patterns [N] vs ["key"]
  • Lifecycle meta-arguments: create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by
  • Built-in functions: string, collection, encoding, network, type conversion
  • Dynamic blocks, for expressions, splat expressions, ternary operator
  • precondition and postcondition lifecycle blocks
Domain 9: Understand Terraform Cloud Capabilities ~8%
  • TFC workspaces vs CLI workspaces — key differences and use cases
  • VCS-driven workflow — speculative plans on PRs, auto-apply on merge
  • Sentinel policy-as-code — enforcement levels (advisory/soft-mandatory/mandatory)
  • Variable sets — shared credentials across multiple workspaces
  • Cost estimation — when it runs, required tier (Plus)
  • Remote, local, and agent execution modes
  • cloud block vs remote backend — cloud block is modern standard
  • TFC vs TFE (self-hosted, air-gap, data residency)
Phase 1 — Weeks 1–2
IaC Foundations & Terraform Setup
Build the conceptual framework and master the development environment

Core Concepts to Master

IaC principles & benefits
Declarative vs imperative
Terraform architecture
Provider ecosystem
Terraform CLI install
HCL syntax basics
terraform init
required_providers
.terraform.lock.hcl
registry.terraform.io

Hands-On Labs

Lab 1.1: First Terraform Configuration

Install Terraform, configure the AWS/Azure provider, write your first resource block (S3 bucket or storage account), run the full init → plan → apply → destroy cycle. Observe what the .terraform/ directory contains after init.

Lab 1.2: Version Constraints Practice

Experiment with version constraint operators: ~> (pessimistic), >=, =, != for both required_version and required_providers. Practice what happens when you specify incompatible constraints. Examine .terraform.lock.hcl before and after terraform init -upgrade.

Learning Resources

  • HashiCorp Terraform Getting Started tutorial — learn.hashicorp.com (FREE)
  • HashiCorp Certified: Terraform Associate (003) Study Guide — official exam guide
  • Terraform Full Course for Beginners — freeCodeCamp YouTube (FREE)
  • Terraform documentation at terraform.io/docs (always free)

Phase 1 Tips

  • Install tfenv (Linux/Mac) or tfswitch to manage multiple Terraform versions easily
  • Use the official HashiCorp VS Code extension for HCL syntax highlighting and completion
  • Practice on a real cloud account — AWS Free Tier or Azure Student Subscription works great
  • Read the exam guide PDF from HashiCorp — it lists exact objectives weighted by domain
Phase 2 — Weeks 3–4
HCL Configuration Language Mastery
Deep dive into variables, functions, expressions, and dynamic configuration

Core Concepts to Master

Variables & validation
Locals block
Outputs
Data sources
count vs for_each
Lifecycle meta-args
Ternary operator
For expressions
Splat expressions
Dynamic blocks
String functions
Collection functions
Network functions
Type conversions
templatefile()
terraform console

Hands-On Labs

Lab 2.1: Variables Deep Dive

Create a configuration with all variable types (string, number, bool, list, map, object). Test all 5 precedence levels by providing values via -var flag, .tfvars file, environment variables (TF_VAR_), and defaults. Implement validation blocks with can() and contains().

Lab 2.2: Functions with terraform console

Open terraform console and practice: cidrsubnet for VPC subnetting, flatten/merge/toset for collection manipulation, jsonencode for AWS policies, templatefile for user-data scripts, try() and can() for error handling. Build all the subnet CIDRs for a 3-AZ VPC using only cidrsubnet.

Lab 2.3: count vs for_each Migration

Create 3 S3 buckets with count, then migrate to for_each. Observe how removing one item causes different behavior: count causes replacement of subsequent resources, for_each only affects the removed key. This is a critical exam concept.

Lab 2.4: Dynamic Blocks for Security Groups

Build an AWS security group where ingress rules are driven by a variable list of objects. Add/remove rules by editing the variable — no changes to resource block needed. Practice with nested dynamic blocks.

Learning Resources

  • Terraform Language documentation — Configuration Language section — terraform.io
  • HashiCorp Learn: Functions tutorial series (FREE)
  • Terraform Variables, Locals, Outputs — TechWorld with Nana (FREE)
  • Bryan Krausen: HashiCorp Certified Terraform Associate Practice Exam — Udemy
Phase 3 — Weeks 5–6
State Management & Remote Backends
Master state operations, remote backends, locking, and drift remediation

Core Concepts to Master

Remote backends
S3 + DynamoDB setup
State locking
Partial backend config
terraform state list
terraform state mv
terraform state rm
terraform import
moved block
terraform_remote_state
Drift detection
Terraform workspaces

Hands-On Labs

Lab 3.1: S3 Remote Backend + DynamoDB Locking

Create an S3 bucket and DynamoDB table (LockID hash key) manually or via separate Terraform config. Configure your main workspace to use S3 backend with DynamoDB locking. Migrate existing local state to S3 via terraform init (it offers to copy state). Verify locking: open two terminals, run terraform plan simultaneously and observe one being blocked.

Lab 3.2: Import Existing Resource

Create a resource manually in AWS console (e.g., security group). Write a resource block in Terraform, run terraform import, then run terraform plan until there's no diff. Practice generating config with -generate-config-out (TF 1.5+).

Lab 3.3: State Refactoring with moved Block

Rename a resource in your config (e.g., aws_instance.app to aws_instance.web), add a moved block, and verify that terraform plan shows no resource replacement — only a state rename. Then migrate a count-based resource to for_each using moved blocks for each element.

Learning Resources

  • HashiCorp Learn: Remote State Management tutorial (FREE)
  • HashiCorp Learn: Import tutorial (FREE)
  • Terraform state documentation — Backend configuration, workspace commands
  • Practice: Simulate drift by manually changing a resource in AWS console, then run terraform plan to see it detected

State Management Exam Tips

  • DynamoDB table for locking MUST have hash key named exactly "LockID" (string type)
  • terraform state rm removes from state — cloud resource is NOT deleted
  • terraform destroy in a workspace only destroys resources in THAT workspace's state
  • State file contains secrets in plain text — always encrypt (S3 server-side encryption + restrict access)
  • moved block is idempotent — safe to apply again, can be removed after team has updated state
Phase 4 — Weeks 7–8
Modules & Terraform Cloud
Build reusable modules and master Terraform Cloud team collaboration features

Core Concepts to Master

Module structure
Module source types
Version constraints
path.module vs path.root
Terraform Cloud workspaces
cloud block
VCS-driven workflow
Sentinel policies
Variable sets
Execution modes
Cost estimation
Private registry
Team permissions
Run triggers
TFC API
TFE vs TFC

Hands-On Labs

Lab 4.1: Build and Publish a Reusable Module

Create a terraform-aws-webserver module (or Azure equivalent) with proper structure: main.tf, variables.tf, outputs.tf, versions.tf, README.md. Call it from a root configuration using local source path, then push to GitHub and reference it via Git URL with version pinning.

Lab 4.2: Terraform Cloud VCS Workflow

Create a free Terraform Cloud account, connect it to a GitHub repo, create a workspace in VCS-driven mode. Create a PR — observe TFC posting a speculative plan. Merge the PR — observe TFC queueing a run. Approve and apply the run in TFC UI.

Lab 4.3: Variable Sets for Credential Management

Create a variable set with cloud credentials (AWS or Azure environment variables, marked sensitive). Apply to your TFC workspace. Verify the workspace can authenticate to cloud without workspace-specific credentials. Create a second workspace and apply the same variable set — observe how a single set serves multiple workspaces.

Sentinel Policy Practice

Lab 4.4: Write a Sentinel Policy

Write a Sentinel policy that prevents EC2 instance types larger than t3.medium. Apply it as a policy set in TFC. Test with a plan that uses t3.large — verify the policy blocks or warns. Change enforcement level from soft-mandatory to advisory and observe different behavior.

Learning Resources

  • HashiCorp Learn: Terraform Cloud Tutorials — learn.hashicorp.com (FREE)
  • HashiCorp Learn: Sentinel Guides — docs.hashicorp.com (FREE)
  • Terraform Module Registry — registry.terraform.io (use community modules)
  • Zeal Vora: HashiCorp Terraform Associate 2024 — Udemy (paid, highly rated)
Phase 5 — Weeks 9–10
Exam Preparation & Final Review
Practice exams, weak area remediation, and exam-day strategy

Exam-Day Prep Checklist

✓ All 9 domains reviewed
✓ 3+ practice exams passed
✓ Core CLI commands memorized
✓ Function syntax tested
✓ TFC features reviewed
✓ State commands drilled
✓ Module sources memorized
✓ Lifecycle blocks mastered

High-Yield Review Topics

🎯 Most Frequently Tested Concepts

count vs for_each: Index corruption on count list removal, stable keys with for_each. Variable precedence: -var > auto.tfvars > TF_VAR_ > default. State locking: DynamoDB LockID key, force-unlock caution. Lifecycle: create_before_destroy, prevent_destroy, ignore_changes. Sentinel: Three enforcement levels and their behaviors. Modules: path.module for portable file references. TFC: VCS speculative plans on PRs, cloud block syntax, variable sets vs workspace vars.

Practice Resources

  • Bryan Krausen: Terraform Associate Practice Exams — Udemy (250+ questions)
  • HashiCorp sample questions in official exam review guide (10–15 official samples)
  • Whizlabs Terraform Associate Practice Tests — (some free questions)
  • ExamTopics — community practice questions (use with caution, verify answers)
  • GitHub: btkrausen/hashicorp — free exam prep questions on GitHub

Exam Strategy

  • Core Workflow (Domain 6 at 20%) — study this domain more than any other; it's worth most
  • Read every answer option carefully — Terraform questions often have 2 "almost correct" options
  • For multi-select (select 2 or 3): eliminate clearly wrong options first, then choose the best from remaining
  • When unsure between two answers, prefer the "HashiCorp recommended" approach (e.g., for_each over count, cloud block over remote backend)
  • Schedule 60 minutes and pace yourself: ~63 seconds per question. Flag uncertain questions and return
  • Use Pearson VUE online proctoring — ensure your environment meets requirements 24 hours before
Career Value
Job Roles & Salary Ranges with Terraform Certification
Market demand for Terraform skills continues to grow rapidly — 65%+ of DevOps job postings mention Terraform
DevOps Engineer
$100K – $150K
Platform Engineer
$115K – $165K
Cloud Architect
$130K – $190K
SRE / Infrastructure Engineer
$120K – $175K
Cloud Engineer
$95K – $145K
Solutions Architect
$130K – $185K

Career Tips

  • Pair Terraform Associate with a cloud provider cert (AWS SAA or AZ-104) for maximum job market appeal
  • Build a GitHub portfolio with real Terraform modules — employers value demonstrated hands-on experience
  • Terraform + Kubernetes (CKA/CKAD) is a highly sought DevOps stack in 2025
  • Terraform Enterprise experience (TFE) significantly increases salary in enterprise environments
  • After Associate, consider Vault Associate for the HashiCorp ecosystem completion

🏗️ Ready to Start Your Terraform Journey?

Practice with 150 exam-quality questions, master core concepts with flashcards, and build real skills with hands-on projects.

🎯 Start Practice Quiz 🃏 Review Flashcards ⚙️ View Projects ← All Certifications