Chapter 33: Terraform Providers Resources Variables Outputs Locals and Data Sources

33.6 Data sources — read what already exists

By Ravindra Bagale · Last updated: 25 October 2026

Story. An Infosys client already had a VPC built by the network team, and the application team was not allowed to touch it. They still needed its id and the latest Amazon Linux AMI. A data block reads existing infrastructure without managing it. Terraform will never create or delete what a data source returns.

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

data "aws_vpc" "shared" {
  tags = { Name = "shared-vpc" }
}

data "aws_caller_identity" "me" {}

resource "aws_instance" "web" {
  ami           = data.aws_ami.al2023.id
  instance_type = var.instance_type
}

output "account_id" {
  value = data.aws_caller_identity.me.account_id
}

What each line does

• data "aws_ami" "al2023" { — Asks AWS for an AMI matching the filters below.
• most_recent = true — If many match, take the newest.
• owners = ["amazon"] — Only trust images published by Amazon.
• filter { name = "name" ... } — Filters on the image name.
• values = ["al2023-ami-*-x86_64"] — Matches Amazon Linux 2023 64-bit Intel images.
• data "aws_vpc" "shared" { — Finds the existing VPC by its Name tag.
• data "aws_caller_identity" "me" {} — Reads the account and role you are running as.
• ami = data.aws_ami.al2023.id — Uses the looked-up AMI id instead of a hard-coded one.
• value = data.aws_caller_identity.me.account_id — Prints the account id so you know which account you are in.

When it is green.

data.aws_ami.al2023: Reading...
data.aws_ami.al2023: Read complete after 1s [id=ami-0abc...]
Plan: 1 to add, 0 to change, 0 to destroy.

When it is red.

Error: Your query returned no results. Please change your search criteria and try again.
  with data.aws_vpc.shared

Fix. The filter matched nothing in this region or account. Check the tag value and the provider region.

What: every term in plain English

• data block — data "TYPE" "NAME" { ... }. Reads something that exists. Never creates or deletes it.
• data.TYPE.NAME.attr — How you read a data source value.
• filter — A way to narrow a search, such as by tag or name.
• aws_ami — Finds an AMI id, such as the latest Amazon Linux.
• aws_vpc / aws_subnets — Find an existing network.
• aws_caller_identity — Tells you the account id Terraform is using.
• aws_ssm_parameter — Reads a value from Parameter Store.

Example 1: Latest Amazon Linux AMI

AMI ids differ per region and change every few weeks. Hard-coding them broke a Wipro pipeline in Hyderabad.

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

output "ami" {
  value = "${data.aws_ami.al2023.id} ${data.aws_ami.al2023.name}"
}

terraform apply -auto-approve
terraform output -raw ami

Output

data.aws_ami.al2023: Reading...
data.aws_ami.al2023: Read complete after 1s [id=ami-0abcdef1234567890]
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
ami-0abcdef1234567890 al2023-ami-2023.6.20261010.0-kernel-6.1-x86_64

What it shows: The id and name are samples. Note: when a new AMI comes out, servers using it will show a replace. Add ignore_changes = [ami] if you do not want that.

Example 2: Use a VPC made by another team

At an Infosys client the network team owns the VPC. The app team must only read it, by tag.

data "aws_vpc" "shared" {
  tags = {
    Name = "shared-vpc"
  }
}

data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.shared.id]
  }
  tags = {
    Tier = "private"
  }
}

resource "aws_security_group" "app" {
  name   = "app-sg"
  vpc_id = data.aws_vpc.shared.id
}

output "private_subnets" {
  value = data.aws_subnets.private.ids
}

terraform plan

Output

data.aws_vpc.shared: Read complete after 1s [id=vpc-0123abcd4567ef890]
data.aws_subnets.private: Read complete after 0s [id=ap-south-1]

  + resource "aws_security_group" "app" {
      + vpc_id = "vpc-0123abcd4567ef890"
    }
Plan: 1 to add, 0 to change, 0 to destroy.

What it shows: The VPC is not in your state. You cannot break it by mistake.

Example 3: Account id for unique names

Bucket names are global. A Paytm-style team adds the account id so names never clash.

data "aws_caller_identity" "me" {}
data "aws_region" "now" {}

resource "aws_s3_bucket" "logs" {
  bucket = "logs-${data.aws_caller_identity.me.account_id}-${data.aws_region.now.name}"
}

terraform plan | grep bucket

Output

+ bucket = "logs-111122223333-ap-south-1"

What it shows: Same code works in every account with no name clash.

Example 4: Read a value from Parameter Store

A Zerodha-style platform team writes the shared ALB listener ARN to SSM. App stacks read it.

aws ssm put-parameter --name /platform/dev/alb_listener_arn --type String \
  --value arn:aws:elasticloadbalancing:ap-south-1:111122223333:listener/app/dev-alb/abc/def

data "aws_ssm_parameter" "listener" {
  name = "/platform/dev/alb_listener_arn"
}

output "listener" {
  value = nonsensitive(data.aws_ssm_parameter.listener.value)
}

terraform apply -auto-approve

Output

{
    "Version": 1,
    "Tier": "Standard"
}
data.aws_ssm_parameter.listener: Read complete after 0s [id=/platform/dev/alb_listener_arn]
Outputs:
listener = "arn:aws:elasticloadbalancing:ap-south-1:111122223333:listener/app/dev-alb/abc/def"

What it shows: SSM values are sensitive by default. nonsensitive() is fine here because an ARN is not a secret. Never use it on passwords.

Command cheat sheet

Verify: did it work?

1. Data read works

   terraform plan | grep "Read complete"
   

   Output

   data.aws_ami.al2023: Read complete after 1s [id=ami-0abcdef1234567890]
   

2. Not in managed resources

   terraform state list | grep "^data"
   

   Output

   data.aws_ami.al2023
   

3. Account id right

   echo data.aws_caller_identity.me.account_id | terraform console
   

   Output

   "111122223333"
   

When it is red 1

Error: no matching EC2 VPC found
  with data.aws_vpc.shared

Cause. The tag or region is wrong, or you are in another account.

Fix, step by step

1. Check tags in the console.
2. Check region and aws sts get-caller-identity.

When it is red 2

Error: Your query returned more than one result. Please try a more specific search criteria, or set `most_recent` attribute to true.

Cause. The AMI filter matched many images.

Fix, step by step

1. Add most_recent = true and owners.

When it is red 3

Error: reading SSM Parameter (/platform/dev/alb_listener_arn): ParameterNotFound

Cause. The parameter does not exist in this region or account.

Fix, step by step

1. Run aws ssm get-parameter --name ... to check.
2. Create it or fix the name.

Cleanup

terraform destroy -auto-approve
aws ssm delete-parameter --name /platform/dev/alb_listener_arn

Practice tasks

Homework: try at home

Recap

• data blocks read, never create or delete.
• Read as data.TYPE.NAME.attr.
• Use filters and tags to find the right object.
• aws_caller_identity makes unique names.
• SSM parameters share values across stacks.

FAQ

Does a data source cost money?

No. It only reads.

Is data in state?

Yes, as a read result, but destroy never deletes it.

When is data read?

During plan, unless it depends on something unknown.

Data or remote state?

Data sources and SSM are looser and safer. Remote state needs read access to the whole state.

Can data find many objects?

Yes, plural ones like aws_subnets return lists.

Interview questions

1. What is a data source?

   A read-only lookup of existing infrastructure, read as data.TYPE.NAME.

2. How do you avoid hard-coded AMI ids?

   data aws_ami with owners, filters and most_recent.

3. How do you use a VPC owned by another team?

   data aws_vpc by tag, and data aws_subnets with filters.

4. How do you make bucket names unique?

   Add the account id from aws_caller_identity.

5. How do stacks share values safely?

   Write them to SSM Parameter Store and read them with a data source.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards