Why data sources query existing infrastructure in Terraform - Visual Breakdown

Process Flow - Why data sources query existing infrastructure

Terraform Plan Start

↓

Identify Data Sources

↓

Query Existing Infrastructure

↓

Retrieve Current State Info

↓

Use Info in Resource Config

↓

Apply Changes with Updated Data

↓

Terraform Plan End

Terraform starts by finding data sources, queries existing infrastructure to get current info, then uses that info to configure resources before applying changes.

Execution Sample

Terraform

data "aws_vpc" "selected" {
  filter {
    name   = "tag:Name"
    values = ["my-vpc"]
  }
}

resource "aws_subnet" "example" {
  vpc_id     = data.aws_vpc.selected.id
  cidr_block = "10.0.1.0/24"
}

This code queries an existing VPC by tag and uses its ID to create a subnet inside it.

Process Table

Step	Action	Query Result	Resource Config Use	Outcome
1	Terraform starts plan	N/A	N/A	Begin execution
2	Identify data source aws_vpc.selected	N/A	N/A	Prepare to query existing VPC
3	Query AWS for VPC with tag Name=my-vpc	VPC found with id vpc-123abc	N/A	Data source populated
4	Use data.aws_vpc.selected.id in aws_subnet resource	vpc-123abc	Subnet vpc_id set to vpc-123abc	Subnet config ready
5	Apply resource creation	N/A	Subnet created in existing VPC	Infrastructure updated
6	Plan complete	N/A	N/A	Execution ends

💡 Terraform finishes after querying existing infrastructure and applying resources using that data.

Status Tracker

Variable	Start	After Step 3	After Step 4	Final
data.aws_vpc.selected.id	undefined	vpc-123abc	vpc-123abc	vpc-123abc
aws_subnet.example.vpc_id	undefined	undefined	vpc-123abc	vpc-123abc

Key Moments - 2 Insights

Why does Terraform query existing infrastructure before creating new resources?

Terraform queries existing infrastructure to get current details like IDs, so new resources can link correctly. See execution_table step 3 where the VPC ID is retrieved before subnet creation.

What happens if the data source query finds no matching resource?

Terraform will fail the plan because it cannot get required info to configure dependent resources. This is implied in step 3 where a VPC must be found to proceed.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what is the query result for the data source?

A No VPC found

B VPC found with id vpc-123abc

C Subnet created

D Terraform plan ends

💡 Hint

Check the 'Query Result' column at step 3 in execution_table.

At which step does Terraform use the data source value to configure a resource?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Resource Config Use' column in execution_table.

If the data source returned a different VPC ID, how would the variable_tracker change?

A No change in variables

B aws_subnet.example.vpc_id would remain undefined

C data.aws_vpc.selected.id would update to new ID

D Terraform would skip subnet creation

💡 Hint

See how data.aws_vpc.selected.id flows into aws_subnet.example.vpc_id in variable_tracker.

Concept Snapshot

Terraform data sources query existing infrastructure to get current info.
This info is used to configure new resources correctly.
Data sources run before resource creation.
If data source fails, plan stops.
Example: Query VPC ID to create subnet inside it.

Full Transcript

Terraform uses data sources to query existing infrastructure before creating new resources. This lets Terraform get current details like IDs or names needed to link new resources properly. For example, it queries a VPC by tag to get its ID, then uses that ID to create a subnet inside that VPC. The execution flow starts with identifying data sources, querying the infrastructure, retrieving info, using it in resource configs, and finally applying changes. If the data source query fails to find the resource, Terraform cannot proceed. This process ensures new resources fit correctly into existing setups.

Practice

1. What is the main reason Terraform uses data sources to query existing infrastructure?

easy

A. To get information about resources created outside Terraform

B. To create new resources automatically

C. To delete unused resources

D. To backup infrastructure state

Solution

1. Step 1: Understand Terraform data sources purpose

   Data sources allow Terraform to read details about resources that exist but were not created by the current Terraform configuration.

2. Step 2: Identify the correct use case

   Since data sources do not create or delete resources, their main use is to fetch information about existing infrastructure.

3. Final Answer:

   To get information about resources created outside Terraform -> Option A

4. Quick Check:

   Data sources read existing resources = A [OK]

Hint: Data sources read info, they don't create or delete [OK]

Common Mistakes:

• Thinking data sources create resources
• Confusing data sources with resource blocks
• Assuming data sources manage resource lifecycle

2. Which of the following is the correct syntax to define a data source in Terraform?

easy

A. output "aws_vpc" "main" { id = "vpc-123456" }

B. resource "aws_vpc" "main" { id = "vpc-123456" }

C. data "aws_vpc" "main" { id = "vpc-123456" }

D. variable "aws_vpc" "main" { id = "vpc-123456" }

Solution

1. Step 1: Identify Terraform block types

   Terraform uses the keyword data to define data sources, resource for resources, output for outputs, and variable for input variables.

2. Step 2: Match syntax for data source

   The correct syntax for a data source starts with data, followed by the provider and resource type, then the name and configuration.

3. Final Answer:

   data "aws_vpc" "main" { id = "vpc-123456" } -> Option C

4. Quick Check:

   Data source syntax starts with 'data' = A [OK]

Hint: Data sources start with 'data' keyword, not 'resource' [OK]

Common Mistakes:

• Using 'resource' instead of 'data' for data sources
• Confusing outputs or variables with data sources
• Incorrect block structure or missing quotes

3. Given this Terraform data source snippet:

data "aws_subnet" "example" {
  filter {
    name   = "tag:Name"
    values = ["public-subnet"]
  }
}

What does data.aws_subnet.example.id return?

medium

A. Creates a new subnet with the name public-subnet

B. Throws an error because filter is invalid

C. Returns a list of all subnet IDs in the AWS account

D. The ID of the subnet tagged with Name=public-subnet

Solution

1. Step 1: Understand the data source filter

   The filter selects the subnet resource with the tag Name equal to "public-subnet".

2. Step 2: Determine the returned value

   Accessing data.aws_subnet.example.id returns the ID of the subnet matching the filter, not creating or listing all subnets.

3. Final Answer:

   The ID of the subnet tagged with Name=public-subnet -> Option D

4. Quick Check:

   Filter selects existing subnet ID = B [OK]

Hint: Filters select existing resources; data source returns their attributes [OK]

Common Mistakes:

• Thinking data source creates resources
• Assuming it returns all subnets without filter
• Misunderstanding filter syntax

4. You wrote this Terraform data source:

data "aws_security_group" "web" {
  name = "web-sg"
}

But Terraform shows an error: "name" is not a valid argument. What is the likely fix?

medium

A. Remove the block entirely; data sources can't query security groups

B. Replace name with filter block to find security group by name

C. Add id argument instead of name

D. Change data to resource

Solution

1. Step 1: Check data source argument rules

   The aws_security_group data source does not accept a direct name argument; it uses filters to find resources.

2. Step 2: Correct usage with filter block

   Use a filter block with name = "group-name" and values = ["web-sg"] to query by name.

3. Final Answer:

   Replace name with filter block to find security group by name -> Option B

4. Quick Check:

   Use filter block for querying by name = D [OK]

Hint: Use filter blocks, not direct name arguments in data sources [OK]

Common Mistakes:

• Using unsupported arguments in data sources
• Confusing resource and data source syntax
• Assuming data sources create or modify resources

5. You want to use a data source to get the latest AMI ID for Ubuntu in your region. Which approach correctly uses a data source to achieve this?

hard

A. data "aws_ami" "ubuntu" {
most_recent = true
owners = ["099720109477"]
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
}
}

B. resource "aws_ami" "ubuntu" {
most_recent = true
owners = ["099720109477"]
}

C. variable "ubuntu_ami" {
default = "ami-123456"
}

D. output "ubuntu_ami" {
value = "ami-123456"
}

Solution

1. Step 1: Identify correct block type for querying existing AMI

   To get info about an existing AMI, use a data block, not resource, variable, or output.

2. Step 2: Verify data source configuration

   The aws_ami data source with most_recent = true, owners, and filter for name pattern correctly fetches the latest Ubuntu AMI ID.

3. Final Answer:

   Use a data source with most_recent, owners, and filter to get latest AMI -> Option A

4. Quick Check:

   Data source with filters fetches latest AMI = C [OK]

Hint: Use data source with filters and most_recent to get latest AMI [OK]

Common Mistakes:

• Using resource block instead of data source
• Hardcoding AMI IDs in variables or outputs
• Not filtering or specifying owners in data source