AMI lookup data source example in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AMI Lookup Data Source Behavior

What does the following Terraform data source configuration do?

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Terraform

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

A It finds the latest Amazon Linux 2 AMI owned by Amazon matching the name pattern.

B It creates a new AMI with the specified name pattern.

C It deletes all AMIs owned by Amazon with the given name pattern.

D It lists all AMIs owned by the current user without filtering.

💡 Hint

Look at the 'data' block and the 'most_recent' attribute.

The 'aws_ami' data source fetches information about an existing AMI. Setting 'most_recent = true' and filtering by name and owner returns the latest matching AMI owned by Amazon.

❓ Configuration

intermediate

Identify the Correct AMI ID Output

Given this Terraform configuration, what will be the value of output.ami_id?

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
}

output "ami_id" {
  value = data.aws_ami.example.id
}

Terraform

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
}

output "ami_id" {
  value = data.aws_ami.example.id
}

A A list of all AMI IDs owned by Amazon.

B The AMI ID string of the latest Amazon Linux 2 AMI matching the filter.

C An error because 'id' is not a valid attribute of the data source.

D Null because no AMI matches the filter.

💡 Hint

The 'id' attribute returns the AMI identifier found by the data source.

The data source returns the latest AMI matching the filter, and 'id' outputs its unique AMI identifier string.

❓ Architecture

advanced

Choosing AMI Lookup Strategy for Multi-Region Deployment

You want to deploy identical infrastructure in multiple AWS regions using Terraform. Which approach ensures you get the correct latest AMI in each region?

Options:

A Use multiple provider aliases for each region and separate 'aws_ami' data sources referencing each provider alias.

B Use a single 'aws_ami' data source with a fixed region set in provider configuration.

C Hardcode the AMI IDs for each region in variables and use them directly.

D Use the 'aws_ami' data source without specifying owners or filters.

💡 Hint

Think about how Terraform handles multiple regions and provider aliases.

Using provider aliases for each region and separate data sources ensures Terraform queries the correct AMI per region dynamically.

❓ security

advanced

Security Implications of AMI Lookup Without Owner Restriction

What is a potential security risk of using the 'aws_ami' data source without specifying the 'owners' attribute when looking up an AMI by name pattern?

A Terraform will create a new AMI instead of looking up existing ones.

B Terraform will fail to find any AMI and cause deployment to stop.

C There is no risk; Terraform always selects official AMIs by default.

D Terraform might select a malicious AMI published by an unknown or untrusted owner.

💡 Hint

Consider who can publish AMIs and how filtering by owner helps.

Without restricting owners, Terraform may pick an AMI from any AWS account, including potentially malicious ones.

❓ service_behavior

expert

Effect of 'most_recent' Attribute in AMI Lookup

What happens if you set 'most_recent = false' in the 'aws_ami' data source with multiple AMIs matching the filter?

Example:

data "aws_ami" "example" {
  most_recent = false
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Terraform

data "aws_ami" "example" {
  most_recent = false
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

A Terraform returns an error because 'most_recent' must be true.

B Terraform returns a list of all matching AMIs.

C Terraform returns the first AMI found matching the filter, which may not be the latest.

D Terraform ignores the filter and returns the latest AMI.

💡 Hint

Check the documentation for 'most_recent' default behavior.

When 'most_recent' is false, Terraform returns the first AMI it finds matching the filter, which may not be the newest.

Practice

1. What is the main purpose of using the aws_ami data source in Terraform?

easy

A. To find the latest Amazon Machine Image (AMI) based on filters

B. To create a new AMI from an existing instance

C. To delete unused AMIs automatically

D. To launch an EC2 instance directly

Solution

1. Step 1: Understand the role of aws_ami data source

   The aws_ami data source is used to query existing AMIs, not to create or delete them.

2. Step 2: Identify its main use

   It helps find the latest AMI by applying filters like name, owner, and tags.

3. Final Answer:

   To find the latest Amazon Machine Image (AMI) based on filters -> Option A

4. Quick Check:

   AMI lookup = find latest AMI [OK]

Hint: Remember: data source reads info, does not create resources [OK]

Common Mistakes:

• Confusing data source with resource creation
• Thinking it deletes AMIs
• Assuming it launches instances directly

2. Which of the following is the correct syntax to lookup an AMI by name prefix and owner in Terraform?

easy

A. resource "aws_ami" "example" { filter { name = "name" values = ["my-ami*"] } owners = ["self"] }

B. data "aws_ami" "example" { filter { name = "name" values = ["my-ami*"] } owners = ["self"] }

C. data "aws_ami" "example" { filter { name = "owner" values = ["self"] } owners = ["my-ami*"] }

D. data "aws_ami" "example" { filter { name = "name" values = "my-ami*" } owners = "self" }

Solution

1. Step 1: Identify correct resource type and block structure

   AMI lookup uses data "aws_ami", not resource. Filters require a block with name and values as a list.

2. Step 2: Check syntax for filters and owners

   Filters use values = ["my-ami*"] (list), and owners is a list of strings like ["self"].

3. Final Answer:

   data "aws_ami" "example" { filter { name = "name" values = ["my-ami*"] } owners = ["self"] } -> Option B

4. Quick Check:

   Correct data source syntax = data "aws_ami" "example" { filter { name = "name" values = ["my-ami*"] } owners = ["self"] } [OK]

Hint: Data source uses 'data', filters need list values [OK]

Common Mistakes:

• Using 'resource' instead of 'data'
• Setting 'values' as string instead of list
• Swapping 'name' and 'owners' fields

3. Given this Terraform snippet:

data "aws_ami" "ubuntu" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }
  owners = ["099720109477"]
}

output "ami_id" {
  value = data.aws_ami.ubuntu.id
}

What will the output ami_id contain?

medium

A. An error because most_recent is not valid here

B. A list of all Ubuntu AMI IDs owned by the user

C. The name of the AMI instead of the ID

D. The ID of the most recent Ubuntu 20.04 AMI owned by Canonical

Solution

1. Step 1: Understand the most_recent flag

   Setting most_recent = true returns the newest AMI matching the filter.

2. Step 2: Analyze the filter and owner

   The filter matches Ubuntu 20.04 AMIs by Canonical's owner ID, so the data source returns the latest matching AMI ID.

3. Final Answer:

   The ID of the most recent Ubuntu 20.04 AMI owned by Canonical -> Option D

4. Quick Check:

   most_recent true = latest AMI ID [OK]

Hint: most_recent true returns single newest AMI ID [OK]

Common Mistakes:

• Thinking it returns a list of AMIs
• Confusing AMI name with ID
• Assuming most_recent is invalid

4. You wrote this Terraform data source to find an AMI:

data "aws_ami" "example" {
  filter {
    name = "name"
    values = "my-ami-*"
  }
  owners = ["self"]
}

Terraform gives an error. What is the problem?

medium

A. The owners field cannot be a list

B. The filter block is missing the most_recent flag

C. The values field must be a list, not a string

D. The name field should be owner

Solution

1. Step 1: Check the values field type

   The values field expects a list of strings, but here it is given as a single string.

2. Step 2: Confirm correct syntax for values

   It should be values = ["my-ami-*"] to be valid.

3. Final Answer:

   The values field must be a list, not a string -> Option C

4. Quick Check:

   values needs list brackets [OK]

Hint: Always use square brackets for filter values [OK]

Common Mistakes:

• Using string instead of list for values
• Misunderstanding owners field format
• Adding unnecessary most_recent flag

5. You want to launch an EC2 instance using the latest Amazon Linux 2 AMI in your Terraform code. Which snippet correctly combines AMI lookup and instance resource?

hard

A. data "aws_ami" "amazon_linux" {
most_recent = true
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
owners = ["137112412989"]
}

resource "aws_instance" "web" {
ami = data.aws_ami.amazon_linux.id
instance_type = "t2.micro"
}

B. resource "aws_ami" "amazon_linux" {
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
owners = ["137112412989"]
}

resource "aws_instance" "web" {
ami = aws_ami.amazon_linux.id
instance_type = "t2.micro"
}

C. data "aws_ami" "amazon_linux" {
filter {
name = "owner"
values = ["137112412989"]
}
most_recent = true
}

resource "aws_instance" "web" {
ami = data.aws_ami.amazon_linux.id
instance_type = "t2.micro"
}

D. data "aws_ami" "amazon_linux" {
most_recent = true
filter {
name = "name"
values = "amzn2-ami-hvm-*-x86_64-gp2"
}
owners = ["137112412989"]
}

resource "aws_instance" "web" {
ami = data.aws_ami.amazon_linux.id
instance_type = "t2.micro"
}

Solution

1. Step 1: Verify correct use of data source for AMI lookup

   data "aws_ami" "amazon_linux" { most_recent = true filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } owners = ["137112412989"] } resource "aws_instance" "web" { ami = data.aws_ami.amazon_linux.id instance_type = "t2.micro" } correctly uses data "aws_ami" with most_recent = true, proper filter with name = "name" and list for values, and correct owner ID.

2. Step 2: Check instance resource references the data source ID

   The aws_instance resource uses ami = data.aws_ami.amazon_linux.id, which is correct to launch with the looked-up AMI.

3. Final Answer:

   data "aws_ami" "amazon_linux" { most_recent = true filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } owners = ["137112412989"] } resource "aws_instance" "web" { ami = data.aws_ami.amazon_linux.id instance_type = "t2.micro" } -> Option A

4. Quick Check:

   Data source + resource with correct references = data "aws_ami" "amazon_linux" { most_recent = true filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } owners = ["137112412989"] } resource "aws_instance" "web" { ami = data.aws_ami.amazon_linux.id instance_type = "t2.micro" } [OK]

Hint: Use data source ID in instance AMI field [OK]

Common Mistakes:

• Using resource instead of data for AMI lookup
• Passing string instead of list in filter values
• Incorrect filter name or owner placement