Terraform Associate 004 #8 Deep Dive on the New Scope: ephemeral, write-only, and Meta-Arguments

Infrastructure Terraform IaC Certification
4 min read

This part gathers the items that are new or carry more weight in 004 — the part of this series that differs most from 003-era materials. The good news for anyone who followed the track is that you have already practiced all of it: the secrets setup in Practice #6 and the meta-arguments in Basics #6 and #7 are exactly that material, rearranged here into the angles the exam asks from.

ephemeral: values that leave no record #

An ephemeral value is one that is stored neither in plan nor in state and exists only during a run. The exam points are its nature and where it fits.

  • Nature: it is evaluated fresh on every run and leaves no record, which makes it suitable for handling secrets.
  • Where it fits: ephemeral resources like ephemeral "random_password", variables and outputs marked ephemeral = true, and the places that can accept ephemeral values (write-only arguments, provider configuration, and so on) form the matching set.
  • Constraint: an ephemeral value cannot go where it would be stored in state, such as a regular resource argument. To pass it there you need the write-only arguments below. This constraint is the bridge to the next section — and the exam’s favorite linking question.

write-only arguments: the root-level answer to plaintext state #

#5 established the problem that state is plaintext and that sensitive only masks the screen. Write-only arguments are the language-level solution to that problem. An argument with the _wo suffix, like password_wo, only passes the value to the provider and stores it in neither plan nor state.

main.tf 
ephemeral "random_password" "db" {
  length = 24
}

resource "aws_db_instance" "main" {
  # ...
  password_wo         = ephemeral.random_password.db.result
  password_wo_version = 1
}

The questions concentrate on why _wo_version exists. Because the value is not in state, Terraform cannot detect that it changed, so when you want to rotate it you do not change the value — you bump the version number to signal the change. The answer to “how do you rotate a write-only value?” is “increment _wo_version”. Keep the three-step distinction straight — sensitive (output masking) → ephemeral (a value with no record) → write-only (delivery with no record) — and every comparison question in this area falls.

depends_on: when it is the right answer #

On to the meta-arguments. The correct direction for depends_on questions is exactly the principle from Basics #6. Terraform infers dependencies automatically from references, so depends_on is only for hidden dependencies that no reference expresses (a resource that only works after an IAM policy has been attached, for example). The option that says “declare depends_on on every resource to make ordering explicit” is wrong: unnecessary declarations only reduce parallelism.

count vs for_each #

  • count: replicates by an integer, uses count.index, and powers the condition ? 1 : 0 idiom for conditional creation.
  • for_each: replicates over a map or set, uses each.key and each.value, and lists need toset().
  • How to choose: identical copies and conditional creation take count; named collections take for_each. The exam staple trap is that with count, removing a middle element shifts the indexes and causes unintended re-creation.

The three lifecycle arguments: distinguish by effect #

ArgumentEffectTypical use
create_before_destroyReverses replacement order to “create, then destroy”Zero-downtime replacement, pairs with name_prefix
prevent_destroyErrors out when a plan would destroy the resourceProtecting production DBs and data resources
ignore_changesIgnores external changes to listed attributes in plandesired_capacity managed by auto scaling

Bundle this with the -replace flag from #4 (the successor to the taint command) and the # forces replacement marker (Basics #7), and the replacement question set is complete. The limits of prevent_destroy — it cannot stop a console deletion, and removing the block removes the protection with it — also appear as scenario questions.

Recap #

What we covered in this post:

  • Ephemeral values exist only during a run, never land in plan or state, and cannot go in regular arguments that state would store
  • Write-only arguments only deliver a value without recording it, and rotation is triggered by incrementing _wo_version, not by changing the value
  • The three-step distinction — sensitive masks the screen, ephemeral is a value with no record, write-only is delivery with no record — is the axis of the comparison questions
  • depends_on is an exception tool, used only for hidden dependencies that references cannot express
  • count’s trap is index shifting while for_each is key-based and safe, and the three lifecycle arguments differ in effect: order reversal, destroy blocking, and change ignoring

In the next post (#9 HCP Terraform), we cover the managed-platform domain whose exam coverage grew in 004: workspaces and projects, variable sets, policies, and drift detection.

X