Resources vs Data Sources

Scenario: A team declares a shared network as a resource in two independent states and both believe they own its lifecycle.

A resource block asks Terraform to manage an object's lifecycle. A data block reads an object owned elsewhere and has no create/delete lifecycle. The distinction is ownership, not whether the object already exists: existing infrastructure can be imported into a resource. Data source arguments select an object; exported attributes feed managed resources. Reads normally occur during refresh or plan, but dependencies can defer them until apply.

Analogy: A resource is an asset on your inventory ledger; a data source is a directory lookup. Looking up a courthouse does not make you its owner.

A worked configuration

data "fakecloud_network" "shared" {
  name = "platform-network"
}
resource "fakecloud_server" "api" {
  name       = "api"
  network_id = data.fakecloud_network.shared.id
}

Ambiguous lookups are production hazards. Query by stable unique identifiers where possible, validate expected results, and document which state or team owns the shared object. Broad tag searches can silently bind an application to the wrong network.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-data-source-discovery Terraform lab. Open /labs/terraform and choose slug tf-data-source-discovery; the lab runs real Terraform against the offline FakeCloud provider.