Querying existing resources in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Terraform data source output

You use a Terraform data source to query an existing AWS VPC by its ID. What will be the value of data.aws_vpc.selected_vpc.cidr_block after applying this configuration?

Terraform

data "aws_vpc" "selected_vpc" {
  id = "vpc-0abc123def456ghij"
}

output "vpc_cidr" {
  value = data.aws_vpc.selected_vpc.cidr_block
}

A "vpc-0abc123def456ghij"

B "10.0.0.0/16"

C null

D SyntaxError

💡 Hint

The data source fetches existing resource attributes, including the CIDR block.

The aws_vpc data source returns the attributes of the existing VPC identified by the given ID. The cidr_block attribute contains the IP range of the VPC, such as "10.0.0.0/16".

🧠 Conceptual

intermediate

Purpose of Terraform data sources

What is the main purpose of using a Terraform data source when working with existing cloud resources?

A To query and reference existing cloud resources without creating them

B To create new cloud resources with predefined settings

C To delete existing cloud resources safely

D To automatically update resource configurations

💡 Hint

Think about how Terraform can use information about resources it did not create.

Terraform data sources allow you to look up and use information about existing resources in your cloud environment without managing their lifecycle.

❓ Configuration

advanced

Correctly querying an existing AWS subnet by tag

Which Terraform configuration correctly queries an existing AWS subnet with the tag Environment=Production and outputs its subnet ID?

A

data "aws_subnet_ids" "prod_subnets" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

output "subnet_id" {
  value = data.aws_subnet_ids.prod_subnets.ids[0]
}

B

data "aws_subnet_ids" "prod_subnets" {
  tags = {
    Environment = "Production"
  }
}

output "subnet_id" {
  value = data.aws_subnet_ids.prod_subnets.ids[0]
}

C

data "aws_subnet" "prod_subnet" {
  tags = {
    Environment = "Production"
  }
}

output "subnet_id" {
  value = data.aws_subnet.prod_subnet.id
}

D

data "aws_subnet" "prod_subnet" {
  filter {
    name   = "tag:Environment"
    values = ["Production"]
  }
}

output "subnet_id" {
  value = data.aws_subnet.prod_subnet.id
}

💡 Hint

Use the correct data source type and filter syntax for multiple subnets.

The aws_subnet_ids data source supports filtering by tags using the filter block. It returns a list of subnet IDs matching the filter. Option A correctly uses filter with name and values to find subnets tagged with Environment=Production.

❓ security

advanced

Security implications of querying existing resources

When using Terraform data sources to query existing cloud resources, what is a key security consideration?

A Data sources automatically grant Terraform full access to modify the queried resources

B Data sources expose sensitive resource credentials in the Terraform state by default

C Terraform must have appropriate read permissions to access the existing resources' metadata

D Using data sources disables encryption for the queried resources

💡 Hint

Think about what permissions Terraform needs to read existing resource information.

Terraform requires read permissions to query existing resources via data sources. It does not get write or modify permissions automatically. Proper IAM roles or policies must be assigned to allow safe querying.

❓ Architecture

expert

Designing Terraform to query multi-cloud existing resources

You need to write a Terraform configuration that queries existing virtual networks from both AWS and Azure in the same deployment. Which approach correctly supports querying both cloud providers' existing networks?

A Use the <code>terraform_remote_state</code> data source to import network IDs from AWS and Azure

B Use a single <code>aws_vpc</code> data source with filters for both AWS and Azure network IDs

C Use the <code>null_resource</code> to run scripts that query networks from both clouds

D Use separate provider blocks for AWS and Azure, then use respective data sources <code>aws_vpc</code> and <code>azurerm_virtual_network</code> to query existing networks

💡 Hint

Terraform supports multiple providers in one configuration.

Terraform can manage multiple cloud providers by defining multiple provider blocks. To query existing resources from AWS and Azure, use their respective data sources under their providers. Option D correctly separates providers and uses the correct data sources.

Practice

1. What is the main purpose of a data block in Terraform?

easy

A. To create new cloud resources from scratch

B. To delete resources that are no longer needed

C. To query and use existing resources created outside the current configuration

D. To define variables for user input

Solution

1. Step 1: Understand the role of data blocks

   data blocks in Terraform are used to look up or query existing resources that were created outside the current Terraform configuration or by other means.

2. Step 2: Differentiate from resource creation

   Unlike resource blocks that create new infrastructure, data blocks only read information without making changes.

3. Final Answer:

   To query and use existing resources created outside the current configuration -> Option C

4. Quick Check:

   Data blocks read existing resources = B [OK]

Hint: Data blocks read existing resources, not create them [OK]

Common Mistakes:

• Confusing data blocks with resource creation
• Thinking data blocks delete resources
• Using data blocks to define variables

2. Which of the following is the correct syntax to query an existing AWS VPC by its ID using a data block?

easy

A. data "aws_vpc" "example" { id = "vpc-123456" }

B. resource "aws_vpc" "example" { id = "vpc-123456" }

C. data "aws_vpc" "example" { vpc_id = "vpc-123456" }

D. data "aws_vpc" "example" { name = "vpc-123456" }

Solution

1. Step 1: Identify correct data block syntax

   The correct syntax uses data followed by the provider resource type and a name, then inside the block the attribute id is used to specify the VPC ID.

2. Step 2: Check attribute correctness

   The attribute to specify the VPC ID is id, not vpc_id or name.

3. Final Answer:

   data "aws_vpc" "example" { id = "vpc-123456" } -> Option A

4. Quick Check:

   Use id attribute in data block = A [OK]

Hint: Use 'id' attribute inside data block to query by resource ID [OK]

Common Mistakes:

• Using resource block instead of data block
• Using wrong attribute names like vpc_id
• Confusing resource creation syntax with data query

3. Given this Terraform data block:

data "aws_subnet" "selected" {
  filter {
    name   = "tag:Name"
    values = ["public-subnet"]
  }
}

What will data.aws_subnet.selected.id return?

medium

A. The ID of the subnet tagged with Name=public-subnet

B. A list of all subnet IDs in the AWS account

C. An error because filter is not allowed in data blocks

D. The name of the subnet instead of the ID

Solution

1. Step 1: Understand the filter block in data source

   The filter block selects resources matching the tag Name=public-subnet.

2. Step 2: Identify the returned attribute

   data.aws_subnet.selected.id returns the ID of the matched subnet, not a list or name.

3. Final Answer:

   The ID of the subnet tagged with Name=public-subnet -> Option A

4. Quick Check:

   Filter selects subnet by tag, id returns its ID = D [OK]

Hint: Filter selects resource; .id returns its ID [OK]

Common Mistakes:

• Thinking filter returns multiple resources
• Assuming .id returns name or list
• Believing filter is invalid in data blocks

4. You wrote this data block to query an existing AWS security group:

data "aws_security_group" "example" {
  name = "my-sg"
}

But Terraform returns an error: "Multiple security groups found with name 'my-sg'". What is the best fix?

medium

A. Remove the name attribute to query all security groups

B. Add a filter block with more specific criteria to narrow the search

C. Change data to resource to create a new security group

D. Rename the security group in AWS to have a unique name

Solution

1. Step 1: Understand the error cause

   The error means multiple security groups share the same name, so Terraform cannot pick one.

2. Step 2: Narrow the query with filters

   Adding a filter block with more attributes (like VPC ID) helps select exactly one security group.

3. Final Answer:

   Add a filter block with more specific criteria to narrow the search -> Option B

4. Quick Check:

   Use filters to avoid multiple matches = C [OK]

Hint: Use filters to narrow data queries when duplicates exist [OK]

Common Mistakes:

• Switching to resource block instead of filtering
• Removing name attribute causing ambiguous query
• Changing AWS resource names unnecessarily

5. You want to use an existing AWS IAM role in your Terraform configuration, but only know its ARN. Which is the best way to query this role using a data block?

hard

A. Use data "aws_iam_role" "existing" { id = "my-role" }

B. Use data "aws_iam_role" "existing" { name = "my-role" } and ignore ARN

C. Use resource "aws_iam_role" "existing" { arn = "arn:aws:iam::123456789012:role/my-role" }

D. Use data "aws_iam_role" "existing" { arn = "arn:aws:iam::123456789012:role/my-role" }

Solution

1. Step 1: Identify correct attribute to query by ARN

   The aws_iam_role data source supports querying by arn attribute to find the exact role.

2. Step 2: Avoid using resource block or wrong attributes

   Using resource block tries to create a new role, which is incorrect. Using name may fail if multiple roles share the name. id is not a valid attribute here.

3. Final Answer:

   Use data "aws_iam_role" "existing" { arn = "arn:aws:iam::123456789012:role/my-role" } -> Option D

4. Quick Check:

   Query IAM role by ARN using data block = A [OK]

Hint: Query IAM role by ARN attribute in data block [OK]

Common Mistakes:

• Using resource block instead of data block
• Querying by name when ARN is known
• Using invalid attribute 'id' for IAM role