AMI lookup data source example in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AMI Lookup Data Source Behavior

What does the following Terraform data source configuration do?

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Terraform

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

A It finds the latest Amazon Linux 2 AMI owned by Amazon matching the name pattern.

B It creates a new AMI with the specified name pattern.

C It deletes all AMIs owned by Amazon with the given name pattern.

D It lists all AMIs owned by the current user without filtering.

💡 Hint

Look at the 'data' block and the 'most_recent' attribute.

The 'aws_ami' data source fetches information about an existing AMI. Setting 'most_recent = true' and filtering by name and owner returns the latest matching AMI owned by Amazon.

❓ Configuration

intermediate

Identify the Correct AMI ID Output

Given this Terraform configuration, what will be the value of output.ami_id?

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
}

output "ami_id" {
  value = data.aws_ami.example.id
}

Terraform

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
}

output "ami_id" {
  value = data.aws_ami.example.id
}

A A list of all AMI IDs owned by Amazon.

B The AMI ID string of the latest Amazon Linux 2 AMI matching the filter.

C An error because 'id' is not a valid attribute of the data source.

D Null because no AMI matches the filter.

💡 Hint

The 'id' attribute returns the AMI identifier found by the data source.

The data source returns the latest AMI matching the filter, and 'id' outputs its unique AMI identifier string.

❓ Architecture

advanced

Choosing AMI Lookup Strategy for Multi-Region Deployment

You want to deploy identical infrastructure in multiple AWS regions using Terraform. Which approach ensures you get the correct latest AMI in each region?

Options:

A Use multiple provider aliases for each region and separate 'aws_ami' data sources referencing each provider alias.

B Use a single 'aws_ami' data source with a fixed region set in provider configuration.

C Hardcode the AMI IDs for each region in variables and use them directly.

D Use the 'aws_ami' data source without specifying owners or filters.

💡 Hint

Think about how Terraform handles multiple regions and provider aliases.

Using provider aliases for each region and separate data sources ensures Terraform queries the correct AMI per region dynamically.

❓ security

advanced

Security Implications of AMI Lookup Without Owner Restriction

What is a potential security risk of using the 'aws_ami' data source without specifying the 'owners' attribute when looking up an AMI by name pattern?

A Terraform will create a new AMI instead of looking up existing ones.

B Terraform will fail to find any AMI and cause deployment to stop.

C There is no risk; Terraform always selects official AMIs by default.

D Terraform might select a malicious AMI published by an unknown or untrusted owner.

💡 Hint

Consider who can publish AMIs and how filtering by owner helps.

Without restricting owners, Terraform may pick an AMI from any AWS account, including potentially malicious ones.

❓ service_behavior

expert

Effect of 'most_recent' Attribute in AMI Lookup

What happens if you set 'most_recent = false' in the 'aws_ami' data source with multiple AMIs matching the filter?

Example:

data "aws_ami" "example" {
  most_recent = false
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Terraform

data "aws_ami" "example" {
  most_recent = false
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

A Terraform returns an error because 'most_recent' must be true.

B Terraform returns a list of all matching AMIs.

C Terraform returns the first AMI found matching the filter, which may not be the latest.

D Terraform ignores the filter and returns the latest AMI.

💡 Hint

Check the documentation for 'most_recent' default behavior.

When 'most_recent' is false, Terraform returns the first AMI it finds matching the filter, which may not be the newest.