Data source vs resource difference in Terraform - CLI Comparison

Introduction

When managing infrastructure with Terraform, you often need to use existing resources or create new ones. Data sources let you read information about existing infrastructure, while resources let you create or change infrastructure. Understanding the difference helps you manage your cloud setup correctly.

When you want to use details of an existing cloud resource without changing it, like reading a VPC ID.

When you need to create a new server, database, or network component from scratch.

When you want to reference existing infrastructure in your Terraform code without managing its lifecycle.

When you want Terraform to manage the lifecycle of a resource, including creation, update, and deletion.

When you want to combine existing infrastructure data with new resources in your setup.

Config File - main.tf

main.tf

provider "aws" {
  region = "us-east-1"
}

# Data source to read existing VPC
 data "aws_vpc" "existing_vpc" {
  default = true
}

# Resource to create a new EC2 instance
 resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  subnet_id     = data.aws_vpc.existing_vpc.default_network_acl_id
  tags = {
    Name = "example-instance"
  }
}

The provider block sets the AWS region.

The data block reads information about the default VPC without changing it.

The resource block creates a new EC2 instance using the AMI and instance type specified. It uses the subnet ID from the existing VPC data source.

Commands

This command initializes the Terraform working directory. It downloads the AWS provider plugin needed to manage AWS resources.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/aws...

- Installing hashicorp/aws v4.0.0...

- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)



Terraform has been successfully initialized!

This command shows what Terraform will do. It reads the existing VPC data source and plans to create a new EC2 instance using that information.

Terminal

terraform plan

Expected Output

Refreshing Terraform state in-memory prior to plan...



An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # aws_instance.example will be created

  + resource "aws_instance" "example" {

      + ami           = "ami-0c55b159cbfafe1f0"

      + instance_type = "t2.micro"

      + subnet_id     = "subnet-12345678"

      + tags          = {

          + "Name" = "example-instance"

        }

    }



Plan: 1 to add, 0 to change, 0 to destroy.

This command applies the planned changes. It creates the new EC2 instance using the subnet from the existing VPC data source.

Terminal

terraform apply -auto-approve

Expected Output

aws_instance.example: Creating...

aws_instance.example: Still creating... [10s elapsed]

aws_instance.example: Creation complete after 20s [id=i-0abcd1234efgh5678]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approve the apply without asking for confirmation

This command shows the current state of the infrastructure Terraform manages, including the new EC2 instance and the data source information.

Terminal

terraform show

Expected Output

aws_instance.example:

  id = i-0abcd1234efgh5678

  ami = ami-0c55b159cbfafe1f0

  instance_type = t2.micro

  subnet_id = subnet-12345678



Data Source aws_vpc.existing_vpc:

  id = vpc-87654321

  default_subnet_id = subnet-12345678

Key Concept

Data sources let you read existing infrastructure without changing it, while resources let you create or manage infrastructure.

Common Mistakes

Using a data source when you want Terraform to create or manage a resource.

Data sources only read existing resources and do not create or change anything, so Terraform will not manage the lifecycle.

Use a resource block when you want Terraform to create, update, or delete infrastructure.

Trying to create a resource with the same name or ID as an existing resource read by a data source.

This can cause conflicts or errors because Terraform tries to create something that already exists.

Use data sources to reference existing resources and resources to create new unique infrastructure.

Summary

Use data sources to read information about existing infrastructure without changing it.

Use resources to create and manage new infrastructure components.

Run 'terraform init' to prepare, 'terraform plan' to see changes, and 'terraform apply' to make changes.

Practice

1. What is the main difference between a resource and a data source in Terraform?

easy

A. Resources and data sources both create infrastructure but in different clouds.

B. Resources create or manage infrastructure; data sources only read existing information.

C. Resources only read existing infrastructure; data sources create new infrastructure.

D. Resources are temporary; data sources are permanent.

Solution

1. Step 1: Understand resource role

   Resources in Terraform are used to create or manage cloud infrastructure components.

2. Step 2: Understand data source role

   Data sources are used to read information about existing infrastructure without changing it.

3. Final Answer:

   Resources create or manage infrastructure; data sources only read existing information. -> Option B

4. Quick Check:

   Resource = create/manage, Data source = read [OK]

Hint: Resources build; data sources just look up info [OK]

Common Mistakes:

• Thinking data sources create resources
• Confusing resource and data source roles
• Assuming both modify infrastructure
• Believing data sources are temporary

2. Which of the following is the correct syntax to declare a data source in Terraform?

easy

A. data "aws_ami" "example" {}

B. resource "aws_instance" "example" {}

C. source "aws_vpc" "example" {}

D. resource "data_aws_subnet" "example" {}

Solution

1. Step 1: Identify data source syntax

   Data sources use the keyword data followed by the type and name.

2. Step 2: Check options

   data "aws_ami" "example" {} uses data "aws_ami" "example" {}, which is correct syntax for a data source.

3. Final Answer:

   data "aws_ami" "example" {} -> Option A

4. Quick Check:

   Data source starts with 'data' keyword [OK]

Hint: Data sources start with 'data' keyword [OK]

Common Mistakes:

• Using 'resource' keyword for data sources
• Mixing 'source' keyword which doesn't exist
• Prefixing resource with 'data_' incorrectly
• Confusing resource and data source syntax

3. Given this Terraform snippet:

data "aws_vpc" "selected" {
  filter {
    name   = "tag:Name"
    values = ["main-vpc"]
  }
}

resource "aws_subnet" "example" {
  vpc_id     = data.aws_vpc.selected.id
  cidr_block = "10.0.1.0/24"
}

What does the data.aws_vpc.selected.id represent?

medium

A. The ID of an existing VPC filtered by tag "Name=main-vpc".

B. The ID of a subnet created inside the VPC.

C. A random VPC ID generated by Terraform.

D. The ID of a new VPC created by Terraform.

Solution

1. Step 1: Analyze data source usage

   The data "aws_vpc" "selected" block reads an existing VPC filtered by the tag "Name=main-vpc".

2. Step 2: Understand reference in resource

   The resource aws_subnet.example uses data.aws_vpc.selected.id to get the ID of that existing VPC to create a subnet inside it.

3. Final Answer:

   The ID of an existing VPC filtered by tag "Name=main-vpc". -> Option A

4. Quick Check:

   Data source reads existing VPC ID [OK]

Hint: Data source reads existing resource info [OK]

Common Mistakes:

• Thinking data source creates new VPC
• Confusing subnet ID with VPC ID
• Assuming random ID generation
• Using resource instead of data source for existing info

4. You wrote this Terraform code but get an error:

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

data "aws_vpc" "main" {
  id = aws_vpc.main.id
}

What is the problem?

medium

A. The data source block is missing a filter instead of id.

B. Data sources cannot reference resources in the same configuration.

C. You cannot use the same name for resource and data source.

D. The resource block is missing a provider configuration.

Solution

1. Step 1: Check naming conflict

   The resource and data source both use the name "main" which causes a naming conflict in Terraform.

2. Step 2: Terraform rules

   Terraform does not allow a resource and a data source to share the same type and name within the same module.

3. Final Answer:

   You cannot use the same name for resource and data source. -> Option C

4. Quick Check:

   Resource and data source names must be unique [OK]

Hint: Resource and data source names must differ [OK]

Common Mistakes:

• Thinking same names cause conflicts
• Believing you always need filters over id
• Assuming data sources can depend on resources
• Blaming missing provider config

5. You want to create a subnet in an existing VPC without recreating the VPC. Which Terraform approach is best?

hard

A. Use a resource block for the VPC and a resource block for the subnet.

B. Use a resource block for the subnet and ignore the VPC.

C. Use a data source block for both VPC and subnet.

D. Use a data source block to read the existing VPC and a resource block to create the subnet.

Solution

1. Step 1: Identify existing infrastructure

   The VPC already exists, so it should not be recreated or managed as a resource.

2. Step 2: Use data source for existing VPC

   Use a data source block to safely read the existing VPC's details without changing it.

3. Step 3: Create subnet resource

   Create a resource block for the subnet to add new infrastructure inside the existing VPC.

4. Final Answer:

   Use a data source block to read the existing VPC and a resource block to create the subnet. -> Option D

5. Quick Check:

   Data source reads existing; resource creates new [OK]

Hint: Read existing with data source; create new with resource [OK]

Common Mistakes:

• Trying to recreate existing VPC as resource
• Using data source to create subnet (not possible)
• Ignoring existing VPC and creating subnet without VPC ID
• Using resource for both causing conflicts