Someone fixed a prod issue by clicking in the console, but the infrastructure is managed by Terraform. What's the problem and fix?

This is a governance scenario disguised as a Terraform question. The interviewer is checking whether you understand that infrastructure-as-code is the source of truth, and that an out-of-band change quietly breaks that contract — even when the change "works."

Why the change is a problem

Terraform reconciles real infrastructure to the state and the code. A manual console fix that isn't in the code is drift: the next terraform apply (run by anyone, for any unrelated change) will compare the world to the code, see the difference, and silently revert your fix — potentially re-breaking production at the worst time. Separately, the console change skipped the entire control framework: no pull request, no peer review, no audit record of who changed what and why. So you have both a technical time bomb and a process gap.

The right fix

Reconcile reality back into code: write the change into Terraform, run terraform plan to confirm it now shows no diff, and apply so code and reality agree (using import if Terraform doesn't yet track the resource). Then add guardrails so this can't recur: least-privilege console access (read-only in prod for most people), SCPs that block risky direct mutations, and automated drift detection that alerts when reality diverges from code.

Why the distractors are dangerous

• "Nothing — it works now." It works until the next apply reverts it. You've left a landmine.
• Delete the Terraform state. The state is Terraform's map of what it manages. Deleting it doesn't "fix" the diff — it makes Terraform forget existing resources, leading to orphaned infrastructure or attempts to recreate things that already exist. This is one of the most destructive actions you can take.
• Stop using Terraform. Abandoning IaC to avoid drift throws away reproducibility, review, and audit — the very things that make production safe to change.

What interviewers look for

Recognizing drift and the silent-revert risk, codifying the fix (with import when needed), and adding preventive guardrails rather than blaming the person who clicked.