HashiCorp Terraform Associate (004) Question 97
Single answer4b Refer to resource attributes and create cross-resource referencesYour team is provisioning an AWS VPC and a security group with Terraform. They want the security group to be created in the same VPC without hardcoding the VPC ID. A teammate writes the following configuration:
resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" }
resource "aws_security_group" "web" { name = "web-sg" vpc_id = "aws_vpc.main.id"
ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } }
When they run terraform plan, Terraform does not treat the VPC ID as a resource reference. Which change should they make to correctly create a cross-resource reference so Terraform understands the dependency?
- A
Change vpc_id = "aws_vpc.main.id" to vpc_id = aws_vpc.main.id
- B
Change vpc_id = "aws_vpc.main.id" to vpc_id = var.aws_vpc.main.id
- C
Add depends_on = [aws_vpc.main.id] to the security group and keep vpc_id unchanged
- D
Change vpc_id = "aws_vpc.main.id" to vpc_id = data.aws_vpc.main.id
Show answer and explanation
Correct answer: A
Explanation
Terraform creates cross-resource relationships by evaluating expressions that reference other managed resources, such as aws_vpc.main.id. This is a core pattern for avoiding hardcoded IDs and letting Terraform infer resource dependencies automatically through its dependency graph. Quoting the entire reference turns it into a plain string, so Terraform no longer interprets it as an expression. According to Terraform language documentation, references to managed resource attributes use the form
- A. Correct.
Correct. In Terraform, resource attributes are referenced with the expression resource_type.resource_name.attribute, without wrapping the entire expression in quotes. Using vpc_id = aws_vpc.main.id creates a true cross-resource reference and lets Terraform build the dependency graph automatically. Because the security group argument depends on the VPC's id attribute, Terraform knows it must create the VPC first.
- B. Incorrect.
Incorrect. var.aws_vpc.main.id is not valid syntax for referencing a managed resource. The var object is only for input variables, accessed as var.variable_name. A common misconception is that all values in Terraform are accessed through a common namespace, but resources, variables, locals, and data sources each have their own reference syntax.
- C. Incorrect.
Incorrect. depends_on can force an explicit dependency, but it does not fix the underlying problem that vpc_id is still a literal string rather than the actual VPC ID value. Also, depends_on should be used only when Terraform cannot infer the dependency from expressions. Here, the best practice is to reference aws_vpc.main.id directly, which both supplies the correct value and creates the dependency.
- D. Incorrect.
Incorrect. data.aws_vpc.main.id would only be valid if there were a separately defined data source named aws_vpc.main. In this scenario, the VPC is being created by the configuration as a managed resource, not looked up as existing infrastructure. This distractor reflects confusion between data sources and managed resources.