HashiCorp Terraform Associate (004) Question 92
Single answer4a Use and differentiate resource and data blocksYour team manages AWS infrastructure with Terraform. A shared VPC and several subnets were created manually months ago and must remain unmanaged by Terraform because another team owns them. You need to deploy a new EC2 instance into the existing environment and ensure Terraform does not try to create or take ownership of the VPC or subnet. Which configuration approach is most appropriate?
- A
Use data blocks to look up the existing VPC and subnet, then reference those values from a resource block that creates the EC2 instance.
- B
Use resource blocks for the VPC and subnet so Terraform can read their current settings without changing anything, then reference them from the EC2 instance resource.
- C
Use local values to define the VPC and subnet IDs directly, because locals are intended for existing infrastructure that should not be managed by Terraform.
- D
Use output blocks in a separate configuration to discover the VPC and subnet, because outputs are the recommended way to query existing infrastructure from a provider.
Show answer and explanation
Correct answer: A
Explanation
The key distinction is that resource blocks define objects Terraform will create, update, or destroy, while data blocks read information about objects that already exist. In this scenario, the VPC and subnet already exist and must remain unmanaged by Terraform, so data sources are the correct choice for discovering them. The EC2 instance is new infrastructure your configuration should manage, so it belongs in a resource block. This aligns with Terraform language guidance: use resources for managed infrastructure and data sources for read-only lookup of external or pre-existing infrastructure. A common misconception is that resource blocks can safely represent existing infrastructure without management implications, but Terraform associates resources with state and lifecycle management. Another misconception is that locals or outputs replace data sources; they do not query provider APIs and are used for different purposes.
- A. Correct.
Correct. Data blocks are used to query and reference infrastructure that already exists outside the current Terraform state, such as a manually created VPC or subnet owned by another team. The EC2 instance itself should be declared in a resource block because Terraform is responsible for creating and managing that new object. This is the standard pattern for combining existing infrastructure discovery with new managed resources.
- B. Incorrect.
Incorrect. Resource blocks represent infrastructure Terraform intends to manage. Declaring the existing VPC and subnet as resources would mean Terraform treats them as managed objects in state, which is not appropriate here unless they are explicitly imported and intentionally brought under Terraform management. Simply using resource blocks does not make them read-only.
- C. Incorrect.
Incorrect. Locals can store expressions or reuse values, but they do not query provider APIs or model existing infrastructure. Hardcoding IDs in locals may work syntactically, but it is not the best approach for discovering existing infrastructure and does not demonstrate the correct distinction between data and resource blocks. It also reduces portability and increases maintenance risk.
- D. Incorrect.
Incorrect. Output blocks expose values from a Terraform configuration after apply; they do not query provider APIs directly. Outputs are useful for sharing values between configurations or modules, but they are not a substitute for data sources when you need Terraform to look up existing provider-managed objects like a VPC or subnet.