Terraform · Infrastructure as code
How do you structure Terraform across multiple environments?
Short answer
Use separate state and ideally separate accounts or projects per environment. Directory-per-environment with shared modules is the clearest default; workspaces and Terragrunt are alternatives with different isolation trade-offs.
Environment strategy is mostly about blast radius. Development, staging and production should not share a state file, because one bad plan could then touch all three. Separate accounts or projects add a stronger credential and quota boundary.
infra/
modules/
network/
app/
envs/
dev/
main.tf
backend.tf
terraform.tfvars
staging/
main.tf
backend.tf
terraform.tfvars
prod/
main.tf
backend.tf
terraform.tfvarsCommon options
- Directory per environment: explicit, easy to review, more duplication
- Workspaces: one code path, weak isolation, easy to target the wrong state
- Terragrunt or a wrapper: generates backends and reduces duplication, adds tooling
- Separate repositories: strongest ownership boundary, harder to keep modules in sync
Promote the same module version through environments rather than copying code. Let the environment differ through variables, account, region and sizing, not through a divergent fork of the configuration. If staging and production drift structurally, the promotion stops being a meaningful test.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why is one shared state file for all environments risky?
- 2How do you promote a change from staging to production?
- 3When would you choose separate accounts over separate directories?
- 4What problem does Terragrunt solve?
Say it in the interview
I separate environments by state first, and ideally by account or project as well, so a plan cannot accidentally cross the production boundary. My default is a directory per environment with shared versioned modules and environment-specific backend and tfvars files. I promote the same module version rather than forking code. Workspaces are convenient but they are not a strong isolation boundary.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.