HashiCorp Terraform Associate (004) Question 91
Single answer4a Use and differentiate resource and data blocksYour team manages AWS infrastructure with Terraform. A security group named "shared-web-sg" and a VPC tagged Name=prod-vpc already exist because they were created by another team outside your configuration. You now need to deploy a new EC2 instance into that existing VPC and attach the existing security group, while ensuring Terraform does not try to create duplicate network objects. Which Terraform approach is the most appropriate?
- A
Define the VPC and security group with resource blocks so Terraform can discover them automatically during plan, then reference those resources from the EC2 instance.
- B
Use data blocks to look up the existing VPC and security group, and use a resource block only for the new EC2 instance that Terraform should create.
- C
Use data blocks for the EC2 instance, VPC, and security group so Terraform can manage all three without changing the current environment.
- D
Define the EC2 instance, VPC, and security group all as resource blocks, then rely on Terraform state refresh to avoid creating duplicates if they already exist.
Show answer and explanation
Correct answer: B
Explanation
This question tests the core distinction between resource and data blocks. In Terraform, resource blocks define infrastructure Terraform manages through CRUD lifecycle operations and stores in state. Data blocks are read-only lookups for existing infrastructure or external information. In a real environment, it is common to deploy new resources into shared infrastructure that already exists, such as a VPC, subnet, AMI, or security group created by another team. In those cases, using data sources is the appropriate pattern unless you intentionally import those existing objects into Terraform state for management. HashiCorp documentation describes resources as managed infrastructure objects and data sources as a way to fetch or compute information for use elsewhere in configuration. Best practice is to use data sources for existing dependencies and resource blocks only for infrastructure the current configuration is intended to manage.
- A. Incorrect.
Incorrect. Resource blocks declare infrastructure Terraform is expected to manage, typically by creating, updating, or destroying it. Terraform does not automatically "discover" pre-existing objects just because you define them as resources. If you write resource blocks for an existing VPC and security group that are not already in state, Terraform will generally plan to create new ones unless you first import them. This option reflects a common misconception that resource blocks can act as lookups.
- B. Correct.
Correct. Data blocks are used to query and reference existing infrastructure that Terraform does not need to create in this configuration, while resource blocks are used for objects Terraform should manage. In this scenario, the existing VPC and security group should be referenced with data sources, and the new EC2 instance should be declared as a resource. This avoids duplicate creation and matches Terraform best practice for consuming existing infrastructure.
- C. Incorrect.
Incorrect. Data blocks do not manage lifecycle operations for infrastructure. They can read information about existing objects, but they cannot create or manage an EC2 instance. The new EC2 instance should be a resource block because Terraform must provision and track it in state.
- D. Incorrect.
Incorrect. Refresh updates Terraform's understanding of objects already tracked in state; it does not prevent duplicate creation for unmanaged infrastructure defined as new resources. If the VPC and security group are declared as resources but are not imported into state, Terraform will treat them as new objects to create. This option confuses refresh behavior with importing or reading existing objects through data sources.