Terraform · Infrastructure as code

What are data sources and when should you use them?

Mediumdata sourceslookupsplanningUpdated Oct 2026

Short answer

Data sources read existing information at plan time without managing it. Use them for AMIs, networks or account details you do not own, and remember their values can change between runs.

A data source queries a provider and exposes the result as read-only attributes. It does not create or delete anything. Typical uses are finding the latest approved AMI, looking up a shared VPC, or reading the current AWS account identity.

hcl

data "aws_ami" "base" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

resource "aws_instance" "app" {
  ami           = data.aws_ami.base.id
  instance_type = "t3.micro"
}

The instance depends on the lookup, so Terraform resolves the AMI before planning the instance.

Where data sources help

Referencing resources owned by another team or stack
Looking up region-specific values instead of hardcoding them
Reading account, partition or availability zone metadata
Discovering an image or secret version selected by policy

Data sources run during plan and refresh, so they need credentials and network access. A lookup that returns the latest AMI can silently change the plan later. For production, pin the result through a variable or an allow-listed image pipeline when reproducibility matters.

A data source is not a way to adopt a resource. To manage an existing object, use an import block and a matching resource configuration.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1What happens when a data source lookup fails during plan?
2How can a data source cause unexpected changes?
3When should you use a data source instead of a variable?
4How does an import differ from a data source?

Say it in the interview

Data sources read information that Terraform does not manage, such as the latest approved AMI or a shared VPC. They are resolved during plan, so they need credentials and can make plans non-deterministic if the underlying value changes. I use them for discovery and cross-team references, but I pin critical values when I need reproducible results. For adopting existing infrastructure, I use import rather than a data source.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interview Browse all questions

Where data sources help

Follow-ups you should expect

Related questions

Now say it out loud.