Resource dependencies (implicit) in Terraform - Step-by-Step Execution

Process Flow - Resource dependencies (implicit)

Define Resource A

↓

Define Resource B

↓

Terraform detects references

↓

Implicit dependency: B depends on A

↓

Terraform plans creation order

↓

Create Resource A first

↓

Create Resource B after A

Terraform scans resource definitions and finds references to other resources, creating implicit dependencies to ensure correct creation order.

Execution Sample

Terraform

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "subnet1" {
  vpc_id = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

Defines a VPC and a subnet that implicitly depends on the VPC via the vpc_id reference.

Process Table

Step	Action	Resource	Dependency Detected	Resulting Order
1	Define aws_vpc.main	aws_vpc.main	None	aws_vpc.main first
2	Define aws_subnet.subnet1	aws_subnet.subnet1	References aws_vpc.main.id	aws_subnet.subnet1 after aws_vpc.main
3	Terraform plans	All resources	Implicit dependency aws_subnet.subnet1 -> aws_vpc.main	Create aws_vpc.main then aws_subnet.subnet1
4	Create aws_vpc.main	aws_vpc.main	N/A	aws_vpc.main created
5	Create aws_subnet.subnet1	aws_subnet.subnet1	Depends on aws_vpc.main	aws_subnet.subnet1 created

💡 All resources created respecting implicit dependencies detected by Terraform.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 5
aws_vpc.main.id	undefined	defined	defined	created	created
aws_subnet.subnet1.vpc_id	undefined	undefined	set to aws_vpc.main.id	set	created

Key Moments - 2 Insights

How does Terraform know that aws_subnet.subnet1 depends on aws_vpc.main without explicit instructions?

Terraform detects the reference aws_vpc.main.id inside aws_subnet.subnet1.vpc_id and creates an implicit dependency, as shown in execution_table step 2.

What happens if the dependency is missing or incorrect?

Terraform would try to create resources in wrong order, causing errors. Implicit dependencies prevent this by ensuring aws_vpc.main is created before aws_subnet.subnet1 (see execution_table steps 4 and 5).

Visual Quiz - 3 Questions

Look at the execution_table, at which step does Terraform detect the implicit dependency?

A Step 4

B Step 1

C Step 2

D Step 5

💡 Hint

Check the 'Dependency Detected' column in execution_table rows.

According to variable_tracker, what is the state of aws_subnet.subnet1.vpc_id after Step 2?

A set to aws_vpc.main.id

B undefined

C created

D deleted

💡 Hint

Look at the 'After Step 2' column for aws_subnet.subnet1.vpc_id in variable_tracker.

If aws_subnet.subnet1 did not reference aws_vpc.main.id, what would happen to the creation order?

A Terraform would create aws_subnet.subnet1 before aws_vpc.main

B Terraform would create aws_vpc.main and aws_subnet.subnet1 in parallel

C Terraform would fail to create any resource

D Terraform would create aws_vpc.main after aws_subnet.subnet1

💡 Hint

Implicit dependencies control order; without references, Terraform may create resources in parallel.

Concept Snapshot

Terraform detects implicit dependencies by scanning resource references.
Resources referencing others create a dependency chain.
Terraform plans creation order accordingly.
No need to manually specify depends_on for these cases.
Ensures resources are created in correct order automatically.

Full Transcript

This visual execution shows how Terraform manages implicit resource dependencies. When a resource references another resource's attribute, Terraform detects this and creates an implicit dependency. For example, a subnet resource referencing a VPC's ID means the subnet depends on the VPC. Terraform plans the creation order so the VPC is created first, then the subnet. Variables track the state of resource attributes as they move from undefined to created. This prevents errors from creating resources in the wrong order. The execution table steps through defining resources, detecting dependencies, planning, and creating resources in order. Key moments clarify how Terraform detects dependencies and why this matters. Quiz questions reinforce understanding by referencing specific steps and variable states.

Practice

1. What does Terraform use to determine the order of resource creation when no explicit depends_on is set?

easy

A. The alphabetical order of resource names

B. The order resources are written in the file

C. References between resources inside the configuration

D. Manual user input during apply

Solution

1. Step 1: Understand Terraform's dependency mechanism

   Terraform automatically detects dependencies by checking if one resource references another inside its configuration.

2. Step 2: Compare with other options

   The order in the file, alphabetical order, or manual input do not affect resource creation order unless explicitly coded.

3. Final Answer:

   References between resources inside the configuration -> Option C

4. Quick Check:

   Implicit dependencies = references [OK]

Hint: Look for resource references to find dependencies [OK]

Common Mistakes:

• Thinking order in file matters
• Assuming alphabetical order controls creation
• Believing manual input sets dependencies

2. Which of the following Terraform resource blocks correctly creates an implicit dependency on aws_vpc.main?

easy

A. resource "aws_subnet" "subnet1" { vpc_id = "vpc-123456", cidr_block = "10.0.1.0/24" }

B. resource "aws_subnet" "subnet1" { cidr_block = "10.0.1.0/24" }

C. resource "aws_subnet" "subnet1" { depends_on = [aws_vpc.main], cidr_block = "10.0.1.0/24" }

D. resource "aws_subnet" "subnet1" { vpc_id = aws_vpc.main.id, cidr_block = "10.0.1.0/24" }

Solution

1. Step 1: Identify implicit dependency via reference

   resource "aws_subnet" "subnet1" { vpc_id = aws_vpc.main.id, cidr_block = "10.0.1.0/24" } references aws_vpc.main.id inside vpc_id, creating an implicit dependency.

2. Step 2: Check other options

   resource "aws_subnet" "subnet1" { cidr_block = "10.0.1.0/24" } lacks any reference, so no implicit dependency. resource "aws_subnet" "subnet1" { depends_on = [aws_vpc.main], cidr_block = "10.0.1.0/24" } uses explicit depends_on, not implicit. resource "aws_subnet" "subnet1" { vpc_id = "vpc-123456", cidr_block = "10.0.1.0/24" } uses a hardcoded string, no reference.

3. Final Answer:

   resource "aws_subnet" "subnet1" { vpc_id = aws_vpc.main.id, cidr_block = "10.0.1.0/24" } -> Option D

4. Quick Check:

   Reference attribute = implicit dependency [OK]

Hint: Implicit dependency needs resource attribute reference, not hardcoded values [OK]

Common Mistakes:

• Confusing explicit depends_on with implicit
• Using hardcoded IDs instead of references
• Missing the reference attribute in resource

3. Given the following Terraform snippet, what is the correct order of resource creation?

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "subnet1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_instance" "web" {
  subnet_id = aws_subnet.subnet1.id
  ami       = "ami-123456"
  instance_type = "t2.micro"
}

medium

A. aws_vpc.main -> aws_subnet.subnet1 -> aws_instance.web

B. aws_instance.web -> aws_subnet.subnet1 -> aws_vpc.main

C. aws_subnet.subnet1 -> aws_vpc.main -> aws_instance.web

D. aws_vpc.main -> aws_instance.web -> aws_subnet.subnet1

Solution

1. Step 1: Identify dependencies from references

   aws_subnet.subnet1 depends on aws_vpc.main via vpc_id. aws_instance.web depends on aws_subnet.subnet1 via subnet_id.

2. Step 2: Determine creation order

   Terraform creates resources in order of dependencies: first aws_vpc.main, then aws_subnet.subnet1, then aws_instance.web.

3. Final Answer:

   aws_vpc.main -> aws_subnet.subnet1 -> aws_instance.web -> Option A

4. Quick Check:

   Dependency chain order = B [OK]

Hint: Follow references to find creation order [OK]

Common Mistakes:

• Ignoring dependency direction
• Assuming alphabetical or file order
• Mixing up resource references

4. You have two resources: aws_security_group.sg and aws_instance.web. The instance should be created after the security group. The code is:

resource "aws_security_group" "sg" {
  name = "web-sg"
}

resource "aws_instance" "web" {
  ami           = "ami-123456"
  instance_type = "t2.micro"
}

Why might Terraform create the instance before the security group, and how to fix it?

medium

A. Because no reference exists; add vpc_security_group_ids = [aws_security_group.sg.id] to instance

B. Because depends_on is missing; add depends_on = [aws_security_group.sg] to instance

C. Because resource names are unordered; rename aws_security_group.sg to sg1

D. Because Terraform always creates instances first; no fix possible

Solution

1. Step 1: Identify missing implicit dependency

   The instance resource does not reference the security group, so Terraform sees no dependency and may create in any order.

2. Step 2: Fix by adding reference

   Adding vpc_security_group_ids = [aws_security_group.sg.id] creates an implicit dependency, ensuring the security group is created first.

3. Final Answer:

   Add vpc_security_group_ids referencing security group to instance -> Option A

4. Quick Check:

   Reference creates implicit dependency [OK]

Hint: Add resource attribute reference to create implicit dependency [OK]

Common Mistakes:

• Relying only on depends_on when reference is better
• Changing resource names expecting order change
• Assuming Terraform creates instances first always

5. You have a Terraform configuration with three resources: aws_lb.lb, aws_lb_target_group.tg, and aws_lb_listener.listener. The listener must be created after the load balancer and target group. The target group references the load balancer's ARN. The listener references the target group's ARN. However, you want to ensure the listener is created only after both are fully ready. Which is the best way to enforce this implicit dependency correctly?

hard

A. Use explicit depends_on everywhere and avoid references

B. Reference aws_lb.lb.arn in aws_lb_target_group.tg and aws_lb_target_group.tg.arn in aws_lb_listener.listener without using depends_on

C. Create the listener first, then the target group and load balancer

D. Add depends_on = [aws_lb.lb, aws_lb_target_group.tg] in aws_lb_listener.listener and no references

Solution

1. Step 1: Understand implicit dependency chaining

   Referencing aws_lb.lb.arn in the target group creates an implicit dependency on the load balancer. Referencing aws_lb_target_group.tg.arn in the listener creates an implicit dependency on the target group.

2. Step 2: Avoid unnecessary explicit depends_on

   Using references allows Terraform to build the dependency graph automatically and safely without manual depends_on, which should be reserved for special cases.

3. Final Answer:

   Use references to create implicit dependencies without depends_on -> Option B

4. Quick Check:

   Implicit references chain dependencies best [OK]

Hint: Chain resource references to build implicit dependencies [OK]

Common Mistakes:

• Overusing depends_on instead of references
• Creating resources in wrong order manually
• Avoiding references and relying only on depends_on