Data source dependencies in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the correct data source dependency resolution

Given the Terraform configuration below, which option correctly describes the order in which Terraform resolves the data sources?

Terraform

data "aws_vpc" "main" {
  filter {
    name   = "tag:Name"
    values = ["main-vpc"]
  }
}

data "aws_subnet" "selected" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }
  filter {
    name   = "tag:Environment"
    values = ["prod"]
  }
}

A Terraform resolves aws_subnet.selected first, then aws_vpc.main because subnet depends on VPC ID.

B Terraform resolves both data sources in parallel since they are independent.

C Terraform cannot resolve either data source because of circular dependency.

D Terraform resolves aws_vpc.main first, then aws_subnet.selected because subnet depends on VPC ID from aws_vpc.main.

💡 Hint

Think about which data source provides input to the other.

The aws_subnet.selected data source uses the VPC ID from aws_vpc.main, so Terraform must resolve aws_vpc.main first to get the ID before it can resolve aws_subnet.selected.

❓ service_behavior

intermediate

Effect of missing data source dependency in Terraform

What happens if a Terraform data source references an attribute from another data source that is not declared or does not exist?

Terraform

data "aws_subnet" "example" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.missing.id]
  }
}

A Terraform will throw a runtime error during plan/apply indicating the reference is invalid.

B Terraform will ignore the missing data source and proceed with a null value.

C Terraform will create a new VPC automatically to satisfy the missing data source.

D Terraform will skip the data source and continue without error.

💡 Hint

Consider what happens when Terraform cannot find a referenced resource or data source.

Terraform requires all referenced data sources to be declared and valid. If a data source references a missing or undeclared data source, Terraform throws an error during plan or apply.

❓ Architecture

advanced

Designing data source dependencies for multi-region infrastructure

You have a Terraform configuration that needs to fetch VPC IDs from multiple AWS regions dynamically using data sources. Which approach ensures correct dependency resolution and avoids race conditions?

A Use a single data source with a for_each loop over regions, referencing each region's VPC data source independently without explicit dependencies.

B Use a local variable to store region list and dynamically create data sources with for_each, relying on Terraform's implicit dependency graph.

C Define separate data sources for each region with explicit depends_on blocks to enforce order of resolution across regions.

D Manually run Terraform apply separately for each region to avoid dependency conflicts.

💡 Hint

Think about how Terraform handles dynamic blocks and implicit dependencies.

Using for_each with a local variable list allows Terraform to create data sources per region dynamically. Terraform's implicit dependency graph manages resolution order without manual depends_on, avoiding race conditions.

❓ security

advanced

Security implications of data source dependencies in Terraform

Which of the following is a security risk when using data source dependencies in Terraform configurations that fetch sensitive information?

A Storing sensitive data fetched by data sources in Terraform state files without encryption.

B Using data sources to fetch public information like AMI IDs.

C Referencing data sources across modules without outputs.

D Using data sources with filters based on tags.

💡 Hint

Consider where Terraform stores data source results and how sensitive data is handled.

Terraform stores all data source results in its state file. If sensitive data is fetched and stored unencrypted, it risks exposure. Public info or referencing across modules is not a security risk by itself.

✅ Best Practice

expert

Optimizing Terraform data source dependencies for large infrastructure

In a large Terraform project with many data sources depending on each other, what is the best practice to optimize plan and apply times while ensuring correct dependency resolution?

A Flatten all data sources into a single module to reduce overhead and force sequential resolution.

B Use explicit depends_on for every data source to control order strictly, even if Terraform can infer dependencies.

C Group related data sources into separate modules with clear input/output interfaces and rely on Terraform's implicit dependency graph.

D Avoid using data sources and hardcode resource IDs to eliminate dependencies.

💡 Hint

Think about modular design and Terraform's dependency management.

Grouping related data sources into modules with clear inputs and outputs helps Terraform manage dependencies efficiently. Explicit depends_on everywhere can slow down plans. Hardcoding IDs reduces flexibility and is error-prone.

Practice

1. What is the main purpose of using data source dependencies in Terraform?

easy

A. To fetch existing resource information before creating new resources

B. To delete resources automatically after creation

C. To speed up Terraform plan execution by skipping resources

D. To create duplicate resources with the same configuration

Solution

1. Step 1: Understand data source role

   Data sources in Terraform are used to read information about existing resources outside Terraform or created by other means.

2. Step 2: Identify dependency purpose

   Dependencies ensure Terraform fetches this existing info before creating or modifying other resources that rely on it.

3. Final Answer:

   To fetch existing resource information before creating new resources -> Option A

4. Quick Check:

   Data source dependencies = fetch info first [OK]

Hint: Data sources get info before resource creation [OK]

Common Mistakes:

• Thinking data sources create or delete resources
• Confusing dependencies with resource lifecycle
• Assuming data sources speed up plans by skipping

2. Which syntax correctly adds an explicit dependency on a data source named aws_vpc.main in a resource block?

easy

A. depends_on = {aws_vpc.main}

B. depends_on = aws_vpc.main

C. depends_on = ["aws_vpc.main"]

D. depends_on = [aws_vpc.main]

Solution

1. Step 1: Recall depends_on syntax

   Terraform expects depends_on to be a list of resource or data source references without quotes.

2. Step 2: Analyze options

   depends_on = [aws_vpc.main] uses a list with the correct reference syntax. depends_on = aws_vpc.main misses list brackets. depends_on = ["aws_vpc.main"] uses quotes making it a string, not a reference. depends_on = {aws_vpc.main} uses braces which is invalid.

3. Final Answer:

   depends_on = [aws_vpc.main] -> Option D

4. Quick Check:

   depends_on requires list of references [OK]

Hint: Use square brackets and no quotes for depends_on [OK]

Common Mistakes:

• Using quotes around resource names
• Omitting square brackets for depends_on
• Using curly braces instead of square brackets

3. Given this Terraform snippet:

data "aws_ami" "example" {
  most_recent = true
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.example.id
  instance_type = "t2.micro"
}

What happens if the data source aws_ami.example fails to find a matching AMI?

medium

A. Terraform will skip the instance creation silently

B. Terraform will create the instance with a default AMI

C. Terraform plan will fail with an error before creating the instance

D. Terraform will retry the data source until it finds an AMI

Solution

1. Step 1: Understand data source failure behavior

   If a data source cannot find the requested resource, Terraform plan fails with an error because it cannot resolve the value.

2. Step 2: Check resource dependency

   The resource depends on the data source's output for the AMI ID, so without it, resource creation cannot proceed.

3. Final Answer:

   Terraform plan will fail with an error before creating the instance -> Option C

4. Quick Check:

   Data source failure = plan error [OK]

Hint: Missing data source value causes plan failure [OK]

Common Mistakes:

• Assuming default values are used automatically
• Thinking Terraform retries data sources
• Believing resource creation skips silently

4. You have this Terraform configuration:

data "aws_subnet" "selected" {
  filter {
    name   = "tag:Name"
    values = ["my-subnet"]
  }
}

resource "aws_instance" "app" {
  ami           = "ami-123456"
  instance_type = "t2.micro"
  subnet_id     = data.aws_subnet.selected.id
  depends_on    = [aws_instance.app]
}

What is the problem with this configuration?

medium

A. The resource depends_on itself causing a circular dependency

B. The data source filter syntax is invalid

C. The subnet_id should not use data source references

D. The instance_type is not a valid type

Solution

1. Step 1: Analyze depends_on usage

   The resource aws_instance.app declares depends_on referencing itself, which creates a circular dependency.

2. Step 2: Understand circular dependency impact

   Circular dependencies cause Terraform to fail planning or applying because it cannot resolve resource order.

3. Final Answer:

   The resource depends_on itself causing a circular dependency -> Option A

4. Quick Check:

   depends_on self-reference = circular dependency error [OK]

Hint: Avoid depends_on referencing the same resource [OK]

Common Mistakes:

• Confusing data source filter syntax as error
• Thinking subnet_id cannot use data sources
• Assuming instance_type is invalid without checking

5. You want to create an AWS security group that allows inbound traffic only from instances in a specific subnet fetched via a data source. Which approach correctly ensures Terraform creates the security group only after the subnet data is fetched?

hard

A. Use depends_on = [data.aws_subnet.target] in the security group resource

B. No need for depends_on; Terraform infers dependency from data source usage

C. Create the security group first, then fetch the subnet data source

D. Use a null_resource to delay security group creation

Solution

1. Step 1: Understand implicit dependencies

   When a resource uses a data source attribute (like subnet ID), Terraform automatically creates a dependency to fetch data first.

2. Step 2: Evaluate explicit depends_on necessity

   Explicit depends_on is not needed unless the dependency is indirect or complex; here, implicit dependency suffices.

3. Final Answer:

   No need for depends_on; Terraform infers dependency from data source usage -> Option B

4. Quick Check:

   Data source usage creates implicit dependency [OK]

Hint: Data source references create implicit dependencies [OK]

Common Mistakes:

• Adding unnecessary depends_on for direct data source use
• Creating resources in wrong order ignoring implicit dependencies
• Using null_resource unnecessarily