HFCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

The provider secures physical infrastructure and the hypervisor, while the customer secures identity, data, guest OS patching, and configuration inside the cloud.

Immutable infrastructure

A practice where servers are replaced rather than modified in place, enabling reproducible deployments and simple rollback by redeploying a prior artifact version.

Declarative provisioning

Describing the desired end state and letting a tool compute the difference, as Terraform does, instead of scripting each step imperatively.

Availability zone

An isolated datacenter group within a region. Distributing resources across multiple zones lets an application survive a single-zone failure.

Terraform state

A file mapping configuration addresses to real resource identifiers, used to compute plans. Remote backends with locking allow safe team collaboration.

count versus for_each

count creates instances by integer index, so removing one shifts the rest; for_each uses stable map or set keys, so removing one leaves others untouched.

terraform import

A command that adopts an existing real resource into Terraform state by address, after which configuration must be written to match it.

lifecycle prevent_destroy

A meta-argument that causes Terraform to fail any plan that would destroy the resource, protecting critical data stores from accidental deletion.

Module inputs and outputs

Child modules accept variables as inputs and expose outputs to callers. Version constraints apply when sourcing modules from a registry.

Security group versus NACL

Security groups are stateful and allow-only; network ACLs are stateless and support both allow and deny rules at the subnet boundary.

CIDR host count

For a prefix p, total addresses equal 2^(32-p). A /26 has 64 addresses and a /28 has 16, minus platform-reserved addresses.

Policy as code

Encoding security rules as machine-evaluated policies, such as Sentinel or OPA, that check Terraform plans before apply and can block non-compliant changes.

Least privilege IAM

Granting only the specific actions on specific resource ARNs that a workload needs, avoiding wildcard actions and long-lived static access keys.

Vault unseal process

Vault starts sealed; a threshold of Shamir key shares reconstructs the master key to decrypt the barrier and make secrets readable.

AppRole auth method

A machine-oriented Vault auth method where a role_id and secret_id pair authenticates a workload and returns a token bound to policies.

KV version 2 paths

Versioned key-value secrets are read and written under <mount>/data/<path>, while version metadata and deletion live under <mount>/metadata/<path>.

Dynamic database credentials

Vault generates short-lived database users on demand, returning them with a lease; credentials are revoked automatically when the lease expires.

Transit secrets engine

Encryption as a service where Vault holds the key and clients call encrypt and decrypt endpoints, so plaintext keys never reach the application.

Vault policy capabilities

HCL rules granting create, read, update, delete, list, sudo, or deny on path patterns. A deny rule always overrides any allow.

Consul service discovery

Services register with a local Consul agent and are resolved by name over DNS or HTTP; failing health checks remove unhealthy instances from results.

Consul intentions

Mesh authorization rules defining which source services may connect to which destinations, enforced by sidecar proxies using mutual TLS identities.

Sidecar proxy

A process running alongside each service instance that terminates mutual TLS, enforces intentions, and forwards traffic to local service ports.

Consul datacenter federation

Multiple datacenters join via WAN gossip, and prepared queries with failover policies let consumers reach remote instances when local ones are unhealthy.

HCP Terraform workspace

The unit binding configuration, variables, remote state, and run history. Runs execute plans, policy checks, and applies in a managed environment.

Speculative plan

A plan triggered by a pull request that reports the proposed changes without applying them, enabling review before merge.

Variable sets

Reusable collections of variables shared across many HCP Terraform workspaces, with workspace-level values overriding set-level values.

HCP Vault HVN

A HashiCorp Virtual Network hosting a managed Vault cluster, reachable through a public endpoint or a peering connection to your own VPC.

Run triggers

HCP Terraform settings that start a run in a dependent workspace after another workspace completes, chaining multi-stage infrastructure deployments.

terraform validate

A command that checks configuration syntax and internal consistency without contacting provider APIs, suitable as a fast CI pipeline gate.

Sentinel enforcement levels

Policy results can be advisory (log only), soft-mandatory (overridable by an authorized user), or hard-mandatory (blocks the run entirely).

OIDC federation in CI

The CI platform presents a signed identity token that the cloud provider exchanges for short-lived credentials, removing stored static secrets.

Drift detection

A scheduled comparison of real infrastructure against recorded state. It reports differences but does not reconcile them; a new apply does.