HashiCorp Terraform Associate (004) Question 40
Single answer2c Write Terraform configuration using multiple providersYour team manages infrastructure in two AWS regions from a single Terraform root module. Most resources are created in us-east-1, but a Route 53 health check must be created using a secondary AWS provider configuration that assumes a different IAM role. A developer wrote the following configuration:
provider "aws" { region = "us-east-1" }
provider "aws" { alias = "ops" region = "us-west-2" assume_role { role_arn = "arn:aws:iam::123456789012:role/ops-role" } }
resource "aws_s3_bucket" "app" { bucket = "example-app-bucket-12345" }
resource "aws_route53_health_check" "app" { fqdn = "app.example.com" type = "HTTPS" }
When Terraform plans this configuration, the health check is proposed using the default AWS provider instead of the aliased provider. What is the best way to ensure only the Route 53 health check uses the secondary provider configuration?
- A
Add provider = aws.ops inside the aws_route53_health_check resource block.
- B
Add region = "us-west-2" directly inside the aws_route53_health_check resource block.
- C
Rename the aliased provider block from aws.ops to route53 so Terraform automatically matches it to aws_route53_health_check resources.
- D
Add required_providers inside the aws_route53_health_check resource block to bind that resource to the secondary provider.
Show answer and explanation
Correct answer: A
Explanation
When a module contains multiple configurations for the same provider, Terraform uses the default configuration unless a resource, data source, or module explicitly references an aliased configuration. The correct pattern is to define multiple provider blocks, give the secondary one an alias, and then use the provider meta-argument in the resource: provider = aws.ops. This is the standard approach for working with multiple regions, multiple accounts, or different credentials in the same configuration. According to Terraform provider configuration documentation, provider settings such as region, credentials, and assume_role are defined in provider blocks, while required_providers in the terraform block declares provider dependencies and version constraints. It does not control which provider instance a specific resource uses.
- A. Correct.
Correct. To use a non-default provider configuration for a specific resource, Terraform requires the resource-level meta-argument provider, such as provider = aws.ops. This explicitly tells Terraform to use the aliased AWS provider configuration for that one resource, while other AWS resources continue using the default provider.
- B. Incorrect.
Incorrect. Resource blocks do not accept arbitrary provider configuration arguments like region unless the resource schema specifically defines them, and aws_route53_health_check does not. Provider settings such as region and assume_role belong in provider blocks, not in individual resources. A common misconception is that changing a region inside a resource can switch provider instances, but Terraform selects the provider configuration before evaluating resource arguments.
- C. Incorrect.
Incorrect. Provider aliases are arbitrary names and are not matched automatically to resource types. Terraform does not infer that a provider alias named route53 should be used for aws_route53_health_check resources. The alias must be referenced explicitly with provider = aws.
. - D. Incorrect.
Incorrect. required_providers is defined in the terraform block to declare provider source addresses and version constraints for the module. It cannot be placed inside a resource block, and it does not select a specific provider configuration instance for an individual resource. This option confuses provider requirements with provider instance selection.