Rules

• Do not use production secrets.
• Justify every answer with OpenTofu terminology.
• Separate configuration, plan, state, backend, provider and real infrastructure.
• Name recovery steps when you mention risky state or apply cases.

Questions

Question 01: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 02: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 03: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 04: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 05: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 06: Outputs

Describe a realistic OpenTofu scenario for Outputs. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 07: Plan und Apply

Describe a realistic OpenTofu scenario for Plan und Apply. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 08: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 09: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 10: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 11: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 12: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 13: Outputs

Describe a realistic OpenTofu scenario for Outputs. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 14: Plan und Apply

Describe a realistic OpenTofu scenario for Plan und Apply. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 15: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 16: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 17: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 18: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 19: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 20: Outputs

Describe a realistic OpenTofu scenario for Outputs. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 21: Plan und Apply

Describe a realistic OpenTofu scenario for Plan und Apply. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 22: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 23: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 24: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 25: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 26: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 27: Outputs

Describe a realistic OpenTofu scenario for Outputs. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 28: Plan und Apply

Describe a realistic OpenTofu scenario for Plan und Apply. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 29: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 30: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 31: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 32: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 33: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 34: Outputs

Describe a realistic OpenTofu scenario for Outputs. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 35: Plan und Apply

Describe a realistic OpenTofu scenario for Plan und Apply. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 36: OpenTofu CLI

Describe a realistic OpenTofu scenario for OpenTofu CLI. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 37: HCL

Describe a realistic OpenTofu scenario for HCL. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 38: Ressourcen

Describe a realistic OpenTofu scenario for Ressourcen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 39: Provider

Describe a realistic OpenTofu scenario for Provider. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Question 40: Variablen

Describe a realistic OpenTofu scenario for Variablen. Which module is affected, which provider interacts, what state or security impact appears and which recovery path is appropriate?

Practical Case Study

You inherit an IaC platform with multiple root modules, local state, unclear provider versions and possible secrets in outputs. Build a review plan covering modules, providers, backends, state, policies, CI, drift, secrets and recovery.

Review Checklist for Fundamentals Assessment

• 01. document configuration and desired state: record which module, provider, resource, state and backend path are affected.
• 02. check provider requirement: record which module, provider, resource, state and backend path are affected.
• 03. explain state impact: record which module, provider, resource, state and backend path are affected.
• 04. assess plan diff: record which module, provider, resource, state and backend path are affected.
• 05. describe backend and locking model: record which module, provider, resource, state and backend path are affected.
• 06. check module boundary: record which module, provider, resource, state and backend path are affected.
• 07. assess variable and output: record which module, provider, resource, state and backend path are affected.
• 08. prove drift: record which module, provider, resource, state and backend path are affected.
• 09. mark secret risk: record which module, provider, resource, state and backend path are affected.
• 10. name policy or CI gate: record which module, provider, resource, state and backend path are affected.
• 11. write down rollback or recovery path: record which module, provider, resource, state and backend path are affected.
• 12. state a team rule: record which module, provider, resource, state and backend path are affected.
• 13. document configuration and desired state: record which module, provider, resource, state and backend path are affected.
• 14. check provider requirement: record which module, provider, resource, state and backend path are affected.
• 15. explain state impact: record which module, provider, resource, state and backend path are affected.
• 16. assess plan diff: record which module, provider, resource, state and backend path are affected.
• 17. describe backend and locking model: record which module, provider, resource, state and backend path are affected.
• 18. check module boundary: record which module, provider, resource, state and backend path are affected.
• 19. assess variable and output: record which module, provider, resource, state and backend path are affected.
• 20. prove drift: record which module, provider, resource, state and backend path are affected.
• 21. mark secret risk: record which module, provider, resource, state and backend path are affected.
• 22. name policy or CI gate: record which module, provider, resource, state and backend path are affected.
• 23. write down rollback or recovery path: record which module, provider, resource, state and backend path are affected.
• 24. state a team rule: record which module, provider, resource, state and backend path are affected.
• 25. document configuration and desired state: record which module, provider, resource, state and backend path are affected.
• 26. check provider requirement: record which module, provider, resource, state and backend path are affected.
• 27. explain state impact: record which module, provider, resource, state and backend path are affected.
• 28. assess plan diff: record which module, provider, resource, state and backend path are affected.
• 29. describe backend and locking model: record which module, provider, resource, state and backend path are affected.
• 30. check module boundary: record which module, provider, resource, state and backend path are affected.
• 31. assess variable and output: record which module, provider, resource, state and backend path are affected.
• 32. prove drift: record which module, provider, resource, state and backend path are affected.
• 33. mark secret risk: record which module, provider, resource, state and backend path are affected.
• 34. name policy or CI gate: record which module, provider, resource, state and backend path are affected.
• 35. write down rollback or recovery path: record which module, provider, resource, state and backend path are affected.
• 36. state a team rule: record which module, provider, resource, state and backend path are affected.

Practice Appendix: Fundamentals Assessment

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is small enough to verify with local HCL artifacts and a Git repository.

A001. OpenTofu CLI

• Task: document configuration and desired state and explicitly relate the observation to OpenTofu CLI.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A002. HCL

• Task: check provider requirement and explicitly relate the observation to HCL.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A003. Ressourcen

• Task: explain state impact and explicitly relate the observation to Ressourcen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A004. Provider

• Task: assess plan diff and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A005. Variablen

• Task: describe backend and locking model and explicitly relate the observation to Variablen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A006. Outputs

• Task: check module boundary and explicitly relate the observation to Outputs.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A007. Plan und Apply

• Task: assess variable and output and explicitly relate the observation to Plan und Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A008. OpenTofu

• Task: prove drift and explicitly relate the observation to OpenTofu.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A009. Configuration

• Task: mark secret risk and explicitly relate the observation to Configuration.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A010. Root Module

• Task: name policy or CI gate and explicitly relate the observation to Root Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A011. Provider

• Task: write down rollback or recovery path and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A012. Resource

• Task: state a team rule and explicitly relate the observation to Resource.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A013. Data Source

• Task: document configuration and desired state and explicitly relate the observation to Data Source.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A014. Variable

• Task: check provider requirement and explicitly relate the observation to Variable.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A015. Output

• Task: explain state impact and explicitly relate the observation to Output.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A016. Local Value

• Task: assess plan diff and explicitly relate the observation to Local Value.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A017. State

• Task: describe backend and locking model and explicitly relate the observation to State.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A018. Backend

• Task: check module boundary and explicitly relate the observation to Backend.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A019. Plan

• Task: assess variable and output and explicitly relate the observation to Plan.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A020. Apply

• Task: prove drift and explicitly relate the observation to Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A021. Module

• Task: mark secret risk and explicitly relate the observation to Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A022. Meta-Argument

• Task: name policy or CI gate and explicitly relate the observation to Meta-Argument.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A023. TACOS

• Task: write down rollback or recovery path and explicitly relate the observation to TACOS.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A024. OpenTofu CLI

• Task: state a team rule and explicitly relate the observation to OpenTofu CLI.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A025. HCL

• Task: document configuration and desired state and explicitly relate the observation to HCL.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A026. Ressourcen

• Task: check provider requirement and explicitly relate the observation to Ressourcen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A027. Provider

• Task: explain state impact and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A028. Variablen

• Task: assess plan diff and explicitly relate the observation to Variablen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A029. Outputs

• Task: describe backend and locking model and explicitly relate the observation to Outputs.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A030. Plan und Apply

• Task: check module boundary and explicitly relate the observation to Plan und Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A031. OpenTofu

• Task: assess variable and output and explicitly relate the observation to OpenTofu.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A032. Configuration

• Task: prove drift and explicitly relate the observation to Configuration.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A033. Root Module

• Task: mark secret risk and explicitly relate the observation to Root Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A034. Provider

• Task: name policy or CI gate and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A035. Resource

• Task: write down rollback or recovery path and explicitly relate the observation to Resource.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A036. Data Source

• Task: state a team rule and explicitly relate the observation to Data Source.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A037. Variable

• Task: document configuration and desired state and explicitly relate the observation to Variable.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A038. Output

• Task: check provider requirement and explicitly relate the observation to Output.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A039. Local Value

• Task: explain state impact and explicitly relate the observation to Local Value.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A040. State

• Task: assess plan diff and explicitly relate the observation to State.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A041. Backend

• Task: describe backend and locking model and explicitly relate the observation to Backend.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A042. Plan

• Task: check module boundary and explicitly relate the observation to Plan.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A043. Apply

• Task: assess variable and output and explicitly relate the observation to Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A044. Module

• Task: prove drift and explicitly relate the observation to Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A045. Meta-Argument

• Task: mark secret risk and explicitly relate the observation to Meta-Argument.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A046. TACOS

• Task: name policy or CI gate and explicitly relate the observation to TACOS.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A047. OpenTofu CLI

• Task: write down rollback or recovery path and explicitly relate the observation to OpenTofu CLI.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A048. HCL

• Task: state a team rule and explicitly relate the observation to HCL.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A049. Ressourcen

• Task: document configuration and desired state and explicitly relate the observation to Ressourcen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A050. Provider

• Task: check provider requirement and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A051. Variablen

• Task: explain state impact and explicitly relate the observation to Variablen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A052. Outputs

• Task: assess plan diff and explicitly relate the observation to Outputs.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A053. Plan und Apply

• Task: describe backend and locking model and explicitly relate the observation to Plan und Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A054. OpenTofu

• Task: check module boundary and explicitly relate the observation to OpenTofu.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A055. Configuration

• Task: assess variable and output and explicitly relate the observation to Configuration.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A056. Root Module

• Task: prove drift and explicitly relate the observation to Root Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A057. Provider

• Task: mark secret risk and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A058. Resource

• Task: name policy or CI gate and explicitly relate the observation to Resource.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A059. Data Source

• Task: write down rollback or recovery path and explicitly relate the observation to Data Source.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A060. Variable

• Task: state a team rule and explicitly relate the observation to Variable.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A061. Output

• Task: document configuration and desired state and explicitly relate the observation to Output.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A062. Local Value

• Task: check provider requirement and explicitly relate the observation to Local Value.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A063. State

• Task: explain state impact and explicitly relate the observation to State.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A064. Backend

• Task: assess plan diff and explicitly relate the observation to Backend.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A065. Plan

• Task: describe backend and locking model and explicitly relate the observation to Plan.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A066. Apply

• Task: check module boundary and explicitly relate the observation to Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A067. Module

• Task: assess variable and output and explicitly relate the observation to Module.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A068. Meta-Argument

• Task: prove drift and explicitly relate the observation to Meta-Argument.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A069. TACOS

• Task: mark secret risk and explicitly relate the observation to TACOS.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A070. OpenTofu CLI

• Task: name policy or CI gate and explicitly relate the observation to OpenTofu CLI.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A071. HCL

• Task: write down rollback or recovery path and explicitly relate the observation to HCL.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A072. Ressourcen

• Task: state a team rule and explicitly relate the observation to Ressourcen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A073. Provider

• Task: document configuration and desired state and explicitly relate the observation to Provider.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A074. Variablen

• Task: check provider requirement and explicitly relate the observation to Variablen.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A075. Outputs

• Task: explain state impact and explicitly relate the observation to Outputs.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A076. Plan und Apply

• Task: assess plan diff and explicitly relate the observation to Plan und Apply.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A077. OpenTofu

• Task: describe backend and locking model and explicitly relate the observation to OpenTofu.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A078. Configuration

• Task: check module boundary and explicitly relate the observation to Configuration.
• Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in dev, staging, prod and CI?
• Security question: Which credentials, state values, provider versions or outputs would be critical?
• Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

Official Sources and Scope

The material is aligned with public OpenTofu documentation. Cloud providers, TACOS platforms, policy engines and secret tools are mentioned only where they explain common OpenTofu workflows. Example artifacts are not instructions to execute against production cloud accounts.

• OpenTofu: https://opentofu.org/
• OpenTofu Language Documentation: https://opentofu.org/docs/language/
• Provider Requirements: https://opentofu.org/docs/language/providers/requirements/
• State: https://opentofu.org/docs/language/state/
• Backend Configuration: https://opentofu.org/docs/language/settings/backends/configuration/
• OpenTofu v1.x Compatibility Promises: https://opentofu.org/docs/language/v1-compatibility-promises/
• OpenTofu at CNCF: https://www.cncf.io/projects/opentofu/
• Linux Foundation: Getting Started with OpenTofu: https://training.linuxfoundation.org/express-learning/getting-started-with-opentofu-lfel1009/
• Linux Foundation Certification Catalog: https://training.linuxfoundation.org/certification-catalog/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered with local OpenTofu artifacts.

Drill 01: root module

• State which module, provider, backend or state boundary is affected by root module.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 02: provider version

• State which module, provider, backend or state boundary is affected by provider version.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 03: state snapshot

• State which module, provider, backend or state boundary is affected by state snapshot.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 04: backend locking

• State which module, provider, backend or state boundary is affected by backend locking.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 05: plan diff

• State which module, provider, backend or state boundary is affected by plan diff.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 06: module output

• State which module, provider, backend or state boundary is affected by module output.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 07: sensitive value

• State which module, provider, backend or state boundary is affected by sensitive value.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 08: policy gate

• State which module, provider, backend or state boundary is affected by policy gate.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 09: import

• State which module, provider, backend or state boundary is affected by import.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 10: moved block

• State which module, provider, backend or state boundary is affected by moved block.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 11: TACOS run

• State which module, provider, backend or state boundary is affected by TACOS run.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 12: recovery

• State which module, provider, backend or state boundary is affected by recovery.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 13: root module

• State which module, provider, backend or state boundary is affected by root module.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 14: provider version

• State which module, provider, backend or state boundary is affected by provider version.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 15: state snapshot

• State which module, provider, backend or state boundary is affected by state snapshot.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.

Drill 16: backend locking

• State which module, provider, backend or state boundary is affected by backend locking.
• Name one command or HCL field that produces evidence.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest recovery path for a shared IaC platform.