Data source block syntax in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the correct data source block syntax

Which of the following Terraform data source blocks is correctly written to fetch an AWS AMI by its name?

A

data "aws_ami" example {
  most_recent = true
  filter {
    name = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

B

data "aws_ami" "example" {
  most_recent = true
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

C

data "aws_ami" "example" {
  most_recent = true
  filter = {
    name = "name"
    values = ["amzn2-ami-hvm-2.0.*-x86_64-gp2"]
  }
  owners = ["amazon"]
}

D

data "aws_ami" "example" {
  most_recent = true
  filter {
    name = "name"
    values = "amzn2-ami-hvm-2.0.*-x86_64-gp2"
  }
  owners = ["amazon"]
}

💡 Hint

Remember that filter is a block, not an assignment, and values must be a list.

Option B correctly uses the data block syntax with the filter block and values as a list. Option B misses quotes around the data source type. Option B incorrectly assigns filter as a map instead of a block. Option B uses a string instead of a list for values.

❓ Configuration

intermediate

Determine the output of a Terraform data source block

Given the following Terraform data source block, what will be the value of data.aws_ami.example.id after apply?

Terraform

data "aws_ami" "example" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }
  owners = ["099720109477"]
}

A The AMI ID of the most recent Ubuntu 20.04 image owned by Canonical

B A list of all AMI IDs matching the filter

C An error because <code>owners</code> must be a string, not a list

D Null because <code>most_recent</code> is not a valid argument

💡 Hint

Check the meaning of most_recent and the type of owners.

The data source fetches the most recent AMI matching the filter and owned by the specified owner ID. owners accepts a list of strings. The result is a single AMI ID, not a list. most_recent is a valid argument.

❓ Architecture

advanced

Choose the correct data source block to reference an existing VPC by tag

You want to reference an existing AWS VPC by its tag Environment=Production in Terraform. Which data source block correctly achieves this?

A

data "aws_vpcs" "prod" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

B

data "aws_vpc" "prod" {
  tags = {
    Environment = "Production"
  }
}

C

data "aws_vpc" "prod" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

D

data "aws_vpc" "prod" {
  filter = {
    name = "tag:Environment"
    values = ["Production"]
  }
}

💡 Hint

Remember that filter is a block and tags is not a valid argument for aws_vpc data source.

Option C correctly uses a filter block with the tag name and value. Option C incorrectly uses tags argument which is not supported. Option C uses aws_vpcs which returns multiple VPCs, not a single one. Option C incorrectly assigns filter as a map instead of a block.

❓ security

advanced

Identify the security risk in a Terraform data source block

Consider this Terraform data source block fetching AWS credentials from the environment. What is the main security risk?

Terraform

data "aws_caller_identity" "current" {}

A It exposes AWS account details in Terraform state files if not encrypted

B It automatically grants admin privileges to the Terraform user

C It stores AWS credentials in plain text in the Terraform configuration

D It allows unauthorized users to modify AWS credentials

💡 Hint

Think about what information aws_caller_identity exposes and where Terraform stores state.

The aws_caller_identity data source reveals AWS account and user details. If Terraform state files are not securely stored or encrypted, this sensitive information could be exposed. It does not modify credentials or grant privileges.

❓ service_behavior

expert

Predict the behavior of a Terraform data source with multiple filters

Given this Terraform data source block, what will be the behavior when applied?

Terraform

data "aws_subnet" "example" {
  filter {
    name   = "tag:Name"
    values = ["subnet-1"]
  }
  filter {
    name   = "availability-zone"
    values = ["us-east-1a"]
  }
}

A It causes a Terraform error because multiple filters are not allowed

B It returns all subnets matching either the tag or the availability zone

C It returns the first subnet matching the tag Name=subnet-1, ignoring the availability zone filter

D It returns the subnet matching both the tag Name=subnet-1 and availability zone us-east-1a

💡 Hint

Consider how multiple filter blocks combine in Terraform data sources.

Multiple filter blocks in a data source combine with AND logic, so the data source returns resources matching all filters. It does not cause an error and does not return resources matching only one filter.