Resources, Data Sources and References

What it is

A resource block declares an infrastructure object that Terraform creates, updates and destroys. A data block (a data source) only reads information about something that already exists, such as an image ID or an existing network.

Both blocks expose attributes. You connect blocks by referring to those attributes, and every reference also tells Terraform which block must be handled first.

How it works

Resource blocks and data blocks

A block starts with its kind, then a type label from the provider, then a local name you choose. The type and name together form the address.

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
}

Here the data source looks up an image and the resource uses its id. Terraform never creates or deletes the image; it only reads it.

Data sources are normally read during planning. If a data source depends on a value that is not known until apply, Terraform defers the read to the apply step.

The local name only needs to be unique within its kind and type in the module. A resource and a data source can share the same type and name because the data. prefix keeps their addresses apart.

Reference syntax

Terraform refers to named values with a fixed pattern.

A resource exposes the arguments you set plus attributes the provider computes, such as id or arn. Computed attributes are "known after apply" in a plan until the object exists. The same addresses are used on the command line, for example terraform plan -target=aws_instance.web to target one resource in exceptional cases.

Instances from count and for_each

When a resource uses count, each instance has a number index starting at 0. With for_each, each instance has the map key or set value as its index.

resource "aws_instance" "app" {
  count         = 3
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
}

output "first_ip" {
  value = aws_instance.app[0].private_ip
}

Splat expressions

A splat expression collects one attribute from every instance into a list. aws_instance.app[*].id returns a list of all three IDs.

The splat works on resources that use count. For a resource that uses for_each, the instances form a map, so you use a for expression instead, for example [for i in aws_instance.app : i.id].

Cross-resource references create order

A reference such as subnet_id = aws_subnet.main.id makes an implicit dependency. Terraform builds its dependency graph from these references, creates the subnet first, then the instance that uses it.

This is why most configurations need no explicit ordering at all. Page 3 of this chapter covers depends_on for the cases where no reference exists.

How the exam asks about this

• "You need the ID of an existing VPC that another team manages." Use a data block; a resource block would try to create a new VPC.
• "Which expression returns the IDs of all instances created with count = 3?" aws_instance.app[*].id, the splat expression.
• "How do you refer to an output named vpc_id from a module called network?" module.network.vpc_id.