Why data sources query existing infrastructure in Terraform - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use data sources in Terraform?

What is the main reason Terraform uses data sources to query existing infrastructure?

A To retrieve information about resources created outside Terraform for use in the current configuration

B To delete resources that are no longer needed

C To create new resources based on existing resource templates

D To automatically update Terraform version to match the infrastructure

💡 Hint

Think about how Terraform can use information from resources it did not create.

Data sources allow Terraform to read information about existing resources, so it can reference them without managing their lifecycle.

❓ service_behavior

intermediate

Effect of data sources on Terraform state

When Terraform uses a data source to query existing infrastructure, what happens to the Terraform state file?

A The state file ignores data source information completely

B The state file deletes the existing resource from the cloud provider

C The state file creates a new resource entry for the data source

D The state file records the data source information but does not manage the resource lifecycle

💡 Hint

Consider how Terraform tracks resources it manages versus resources it only reads.

Data sources add read-only information to the state file without managing or changing the resource lifecycle.

❓ Architecture

advanced

Using data sources to integrate multi-team infrastructure

Your team manages a network infrastructure, and another team manages virtual machines. How can Terraform data sources help your team use the network information without recreating it?

A By deleting the existing network and recreating it within your Terraform configuration

B By querying the existing network resources as data sources, your team can reference network IDs without managing them

C By manually copying network configuration files into your Terraform code

D By importing the network resources into your Terraform state and managing them directly

💡 Hint

Think about how to safely use resources managed by others without conflicts.

Data sources let your team read existing network details to use in your configuration without taking ownership or risking conflicts.

❓ security

advanced

Security considerations when using data sources

What is a key security consideration when Terraform queries existing infrastructure using data sources?

A Disable authentication to speed up data source queries

B Grant Terraform full admin permissions to all resources for flexibility

C Ensure Terraform has read-only permissions to prevent accidental changes to existing resources

D Store sensitive data from data sources in public repositories for easy access

💡 Hint

Think about the principle of least privilege in cloud security.

Granting only read-only permissions to Terraform when using data sources helps prevent unintended changes to existing infrastructure.

✅ Best Practice

expert

Best practice for managing dependencies with data sources

When using Terraform data sources to query existing infrastructure, what is the best practice to ensure reliable and consistent deployments?

A Avoid declaring dependencies and rely on Terraform's automatic ordering

B Explicitly declare dependencies using <code>depends_on</code> to control resource creation order

C Manually run separate Terraform commands for data sources and resources

D Use data sources to create resources dynamically during apply

💡 Hint

Consider how Terraform manages resource creation order and dependencies.

Terraform automatically infers dependencies from configuration references, ensuring data sources are queried before dependent resources are created, avoiding the need for explicit depends_on.

Practice

1. What is the main reason Terraform uses data sources to query existing infrastructure?

easy

A. To get information about resources created outside Terraform

B. To create new resources automatically

C. To delete unused resources

D. To backup infrastructure state

Solution

1. Step 1: Understand Terraform data sources purpose

   Data sources allow Terraform to read details about resources that exist but were not created by the current Terraform configuration.

2. Step 2: Identify the correct use case

   Since data sources do not create or delete resources, their main use is to fetch information about existing infrastructure.

3. Final Answer:

   To get information about resources created outside Terraform -> Option A

4. Quick Check:

   Data sources read existing resources = A [OK]

Hint: Data sources read info, they don't create or delete [OK]

Common Mistakes:

• Thinking data sources create resources
• Confusing data sources with resource blocks
• Assuming data sources manage resource lifecycle

2. Which of the following is the correct syntax to define a data source in Terraform?

easy

A. output "aws_vpc" "main" { id = "vpc-123456" }

B. resource "aws_vpc" "main" { id = "vpc-123456" }

C. data "aws_vpc" "main" { id = "vpc-123456" }

D. variable "aws_vpc" "main" { id = "vpc-123456" }

Solution

1. Step 1: Identify Terraform block types

   Terraform uses the keyword data to define data sources, resource for resources, output for outputs, and variable for input variables.

2. Step 2: Match syntax for data source

   The correct syntax for a data source starts with data, followed by the provider and resource type, then the name and configuration.

3. Final Answer:

   data "aws_vpc" "main" { id = "vpc-123456" } -> Option C

4. Quick Check:

   Data source syntax starts with 'data' = A [OK]

Hint: Data sources start with 'data' keyword, not 'resource' [OK]

Common Mistakes:

• Using 'resource' instead of 'data' for data sources
• Confusing outputs or variables with data sources
• Incorrect block structure or missing quotes

3. Given this Terraform data source snippet:

data "aws_subnet" "example" {
  filter {
    name   = "tag:Name"
    values = ["public-subnet"]
  }
}

What does data.aws_subnet.example.id return?

medium

A. Creates a new subnet with the name public-subnet

B. Throws an error because filter is invalid

C. Returns a list of all subnet IDs in the AWS account

D. The ID of the subnet tagged with Name=public-subnet

Solution

1. Step 1: Understand the data source filter

   The filter selects the subnet resource with the tag Name equal to "public-subnet".

2. Step 2: Determine the returned value

   Accessing data.aws_subnet.example.id returns the ID of the subnet matching the filter, not creating or listing all subnets.

3. Final Answer:

   The ID of the subnet tagged with Name=public-subnet -> Option D

4. Quick Check:

   Filter selects existing subnet ID = B [OK]

Hint: Filters select existing resources; data source returns their attributes [OK]

Common Mistakes:

• Thinking data source creates resources
• Assuming it returns all subnets without filter
• Misunderstanding filter syntax

4. You wrote this Terraform data source:

data "aws_security_group" "web" {
  name = "web-sg"
}

But Terraform shows an error: "name" is not a valid argument. What is the likely fix?

medium

A. Remove the block entirely; data sources can't query security groups

B. Replace name with filter block to find security group by name

C. Add id argument instead of name

D. Change data to resource

Solution

1. Step 1: Check data source argument rules

   The aws_security_group data source does not accept a direct name argument; it uses filters to find resources.

2. Step 2: Correct usage with filter block

   Use a filter block with name = "group-name" and values = ["web-sg"] to query by name.

3. Final Answer:

   Replace name with filter block to find security group by name -> Option B

4. Quick Check:

   Use filter block for querying by name = D [OK]

Hint: Use filter blocks, not direct name arguments in data sources [OK]

Common Mistakes:

• Using unsupported arguments in data sources
• Confusing resource and data source syntax
• Assuming data sources create or modify resources

5. You want to use a data source to get the latest AMI ID for Ubuntu in your region. Which approach correctly uses a data source to achieve this?

hard

A. data "aws_ami" "ubuntu" {
most_recent = true
owners = ["099720109477"]
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
}
}

B. resource "aws_ami" "ubuntu" {
most_recent = true
owners = ["099720109477"]
}

C. variable "ubuntu_ami" {
default = "ami-123456"
}

D. output "ubuntu_ami" {
value = "ami-123456"
}

Solution

1. Step 1: Identify correct block type for querying existing AMI

   To get info about an existing AMI, use a data block, not resource, variable, or output.

2. Step 2: Verify data source configuration

   The aws_ami data source with most_recent = true, owners, and filter for name pattern correctly fetches the latest Ubuntu AMI ID.

3. Final Answer:

   Use a data source with most_recent, owners, and filter to get latest AMI -> Option A

4. Quick Check:

   Data source with filters fetches latest AMI = C [OK]

Hint: Use data source with filters and most_recent to get latest AMI [OK]

Common Mistakes:

• Using resource block instead of data source
• Hardcoding AMI IDs in variables or outputs
• Not filtering or specifying owners in data source