Data source block syntax in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the correct data source block syntax

Which of the following Terraform data source blocks is correctly written to fetch an AWS AMI by its name?

A

data "aws_ami" example {
  most_recent = true
  filter {
    name = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

B

data "aws_ami" "example" {
  most_recent = true
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

C

data "aws_ami" "example" {
  most_recent = true
  filter = {
    name = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

D

data "aws_ami" "example" {
  most_recent = true
  filter {
    name = "name"
    values = "amzn2-ami-hvm-2.0.*-x86_64-gp2"
  }
  owners = ["amazon"]
}

💡 Hint

Remember that filter is a block, not an assignment, and values must be a list.

Option B correctly uses the data block syntax with the filter block and values as a list. Option B misses quotes around the data source type. Option B incorrectly assigns filter as a map instead of a block. Option B uses a string instead of a list for values.

❓ Configuration

intermediate

Determine the output of a Terraform data source block

Given the following Terraform data source block, what will be the value of data.aws_ami.example.id after apply?

Terraform

data "aws_ami" "example" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }
  owners = ["099720109477"]
}

A The AMI ID of the most recent Ubuntu 20.04 image owned by Canonical

B A list of all AMI IDs matching the filter

C An error because <code>owners</code> must be a string, not a list

D Null because <code>most_recent</code> is not a valid argument

💡 Hint

Check the meaning of most_recent and the type of owners.

The data source fetches the most recent AMI matching the filter and owned by the specified owner ID. owners accepts a list of strings. The result is a single AMI ID, not a list. most_recent is a valid argument.

❓ Architecture

advanced

Choose the correct data source block to reference an existing VPC by tag

You want to reference an existing AWS VPC by its tag Environment=Production in Terraform. Which data source block correctly achieves this?

A

data "aws_vpcs" "prod" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

B

data "aws_vpc" "prod" {
  tags = {
    Environment = "Production"
  }
}

C

data "aws_vpc" "prod" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

D

data "aws_vpc" "prod" {
  filter = {
    name = "tag:Environment"
    values = ["Production"]
  }
}

💡 Hint

Remember that filter is a block and tags is not a valid argument for aws_vpc data source.

Option C correctly uses a filter block with the tag name and value. Option C incorrectly uses tags argument which is not supported. Option C uses aws_vpcs which returns multiple VPCs, not a single one. Option C incorrectly assigns filter as a map instead of a block.

❓ security

advanced

Identify the security risk in a Terraform data source block

Consider this Terraform data source block fetching AWS credentials from the environment. What is the main security risk?

Terraform

data "aws_caller_identity" "current" {}

A It exposes AWS account details in Terraform state files if not encrypted

B It automatically grants admin privileges to the Terraform user

C It stores AWS credentials in plain text in the Terraform configuration

D It allows unauthorized users to modify AWS credentials

💡 Hint

Think about what information aws_caller_identity exposes and where Terraform stores state.

The aws_caller_identity data source reveals AWS account and user details. If Terraform state files are not securely stored or encrypted, this sensitive information could be exposed. It does not modify credentials or grant privileges.

❓ service_behavior

expert

Predict the behavior of a Terraform data source with multiple filters

Given this Terraform data source block, what will be the behavior when applied?

Terraform

data "aws_subnet" "example" {
  filter {
    name   = "tag:Name"
    values = ["subnet-1"]
  }
  filter {
    name   = "availability-zone"
    values = ["us-east-1a"]
  }
}

A It causes a Terraform error because multiple filters are not allowed

B It returns all subnets matching either the tag or the availability zone

C It returns the first subnet matching the tag Name=subnet-1, ignoring the availability zone filter

D It returns the subnet matching both the tag Name=subnet-1 and availability zone us-east-1a

💡 Hint

Consider how multiple filter blocks combine in Terraform data sources.

Multiple filter blocks in a data source combine with AND logic, so the data source returns resources matching all filters. It does not cause an error and does not return resources matching only one filter.

Practice

1. What is the main purpose of a data source block in Terraform?

easy

A. To create new cloud resources from scratch

B. To define variables for Terraform configuration

C. To delete existing cloud resources

D. To read information about existing cloud resources without creating new ones

Solution

1. Step 1: Understand the role of data sources

   Data sources in Terraform are used to fetch information about existing resources, not to create or delete them.

2. Step 2: Compare options with this role

   Only To read information about existing cloud resources without creating new ones describes reading existing resource info without creation, matching the data source purpose.

3. Final Answer:

   To read information about existing cloud resources without creating new ones -> Option D

4. Quick Check:

   Data source = read existing info [OK]

Hint: Data sources read existing resources, not create or delete [OK]

Common Mistakes:

• Confusing data sources with resource blocks
• Thinking data sources create resources
• Assuming data sources delete resources

2. Which of the following is the correct syntax to define a data source block for an AWS AMI in Terraform?

easy

A. data "aws_ami" example { filter { name = "name" values = ["my-ami"] } }

B. resource "aws_ami" "example" { filter { name = "name" values = ["my-ami"] } }

C. data "aws_ami" "example" { filter { name = "name" values = ["my-ami"] } }

D. data aws_ami example { filter { name = "name" values = ["my-ami"] } }

Solution

1. Step 1: Identify correct block type and syntax

   Data source blocks start with data, followed by resource type and local name in quotes.

2. Step 2: Check each option

   data "aws_ami" "example" { filter { name = "name" values = ["my-ami"] } } uses correct quotes and block structure. resource "aws_ami" "example" { filter { name = "name" values = ["my-ami"] } } uses resource instead of data. Options A and C miss quotes around local name or resource type.

3. Final Answer:

   data "aws_ami" "example" { filter { name = "name" values = ["my-ami"] } } -> Option C

4. Quick Check:

   Data source syntax = data "type" "name" { ... } [OK]

Hint: Data source block uses data "type" "name" with quotes [OK]

Common Mistakes:

• Using resource instead of data
• Omitting quotes around type or name
• Incorrect block nesting or missing braces

3. Given this Terraform data source block:

data "aws_vpc" "selected" {
  filter {
    name   = "tag:Name"
    values = ["main-vpc"]
  }
}

What will data.aws_vpc.selected.id return?

medium

A. The ID of the VPC tagged with Name=main-vpc

B. The name tag value main-vpc

C. A list of all VPC IDs in the AWS account

D. An error because filter syntax is invalid

Solution

1. Step 1: Understand the filter block

   The filter selects the VPC resource with tag Name equal to main-vpc.

2. Step 2: Identify the returned attribute

   data.aws_vpc.selected.id accesses the ID of the matched VPC, not the tag value or a list.

3. Final Answer:

   The ID of the VPC tagged with Name=main-vpc -> Option A

4. Quick Check:

   Filter selects resource, .id returns its ID [OK]

Hint: Filter narrows resource, .id returns its unique ID [OK]

Common Mistakes:

• Confusing tag value with resource ID
• Expecting a list instead of single ID
• Assuming filter syntax is wrong

4. Identify the error in this Terraform data source block:

data "aws_subnet" "example" {
  filter {
    name = "availability-zone"
    values = "us-west-2a"
  }
}

medium

A. The values attribute should be a list, not a string

B. The filter block is missing a closing brace

C. The data source type aws_subnet does not support filters

D. The local name example must be uppercase

Solution

1. Step 1: Check the values attribute type

   In Terraform, filter values must be a list, even if only one value is given.

2. Step 2: Verify the given values

   The code uses a string instead of a list, which causes a syntax error.

3. Final Answer:

   The values attribute should be a list, not a string -> Option A

4. Quick Check:

   Filter values = list, not string [OK]

Hint: Always use list syntax ["value"] for filter values [OK]

Common Mistakes:

• Using string instead of list for values
• Assuming filter block needs no braces
• Thinking local name case matters

5. You want to use a data source block to get the latest Amazon Linux 2 AMI ID filtered by owner and name pattern. Which of these blocks correctly achieves this?

hard

A. resource "aws_ami" "latest" {
most_recent = true
owners = ["amazon"]
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
}

B. data "aws_ami" "latest" {
most_recent = true
owners = ["amazon"]
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
}

C. data "aws_ami" "latest" {
filter {
name = "owner"
values = ["amazon"]
}
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
}

D. data "aws_ami" "latest" {
most_recent = true
owner = "amazon"
filter {
name = "name"
values = ["amzn2-ami-hvm-*-x86_64-gp2"]
}
}

Solution

1. Step 1: Confirm correct block type and attributes

   Use data block for reading AMI info, with most_recent = true and owners as a list.

2. Step 2: Check filter and owner syntax

   data "aws_ami" "latest" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } } correctly uses owners list and a filter for name pattern. data "aws_ami" "latest" { filter { name = "owner" values = ["amazon"] } filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } } incorrectly filters owner as a filter. resource "aws_ami" "latest" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } } uses resource block instead of data. data "aws_ami" "latest" { most_recent = true owner = "amazon" filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } } uses singular owner instead of owners list.

3. Final Answer:

   data "aws_ami" "latest" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } } -> Option B

4. Quick Check:

   Use data block, owners list, most_recent true [OK]

Hint: Use owners list and most_recent true in data block [OK]

Common Mistakes:

• Using resource block instead of data
• Filtering owner instead of using owners attribute
• Using singular owner instead of owners list