HashiCorp Terraform Associate (004) Question 95
Single answer4a Use and differentiate resource and data blocksYour team manages AWS infrastructure with Terraform. A networking team has already created a VPC and several subnets outside of your Terraform configuration, and your application team must deploy a new EC2 instance into one of those existing private subnets. The team wants Terraform to create only the EC2 instance and security group, while looking up the existing VPC and subnet information at plan time. Which configuration approach best meets this requirement?
- A
Use data blocks to look up the existing VPC and subnet, and use resource blocks to create the EC2 instance and security group.
- B
Use resource blocks for the VPC, subnet, EC2 instance, and security group so Terraform can manage all infrastructure consistently.
- C
Use data blocks for the EC2 instance and security group because they depend on existing network values, and use resource blocks only for the VPC and subnet.
- D
Use locals to define the VPC and subnet so Terraform treats them as existing infrastructure, and use resource blocks for the EC2 instance and security group.
Show answer and explanation
Correct answer: A
Explanation
The key distinction is that resource blocks manage infrastructure lifecycle, while data blocks read information about infrastructure that already exists. In a real-world environment, teams often need to deploy into shared networking components such as pre-existing VPCs and subnets. Terraform data sources are designed for this use case because they query the provider during planning and make the results available to resources. A common best practice is to use data sources when consuming externally managed or separately managed infrastructure, and resource blocks only for objects the current configuration should own. This aligns with Terraform documentation on resources and data sources: resources describe objects Terraform manages, while data sources allow Terraform to fetch and use external or existing information.
- A. Correct.
Correct. In Terraform, data blocks are used to query and reference infrastructure that already exists but is not being created by the current configuration. Resource blocks are used to declare infrastructure that Terraform should create, update, or destroy. In this scenario, the existing VPC and subnet should be read with data sources, while the new EC2 instance and security group should be defined as resources.
- B. Incorrect.
Incorrect. This would tell Terraform to create and manage the VPC and subnet rather than simply reference existing ones. That does not match the requirement that the networking team already created those objects outside of this configuration. A candidate might choose this because managing everything in Terraform is often desirable, but it is not appropriate when the goal is to consume existing infrastructure without recreating it.
- C. Incorrect.
Incorrect. Data blocks do not create infrastructure; they only read information from providers. EC2 instances and security groups that the application team wants Terraform to provision must be declared with resource blocks. This option reverses the intended roles of resource and data blocks, which is a common misconception.
- D. Incorrect.
Incorrect. Locals are just named expressions within a Terraform configuration. They do not query provider APIs and do not represent existing infrastructure. If the subnet and VPC IDs were hardcoded into locals, Terraform could use those values, but locals would not 'look up' or validate the existing AWS objects the way data sources do.