Data Sources

mkdir terraform-lesson-13
cd terraform-lesson-13
touch versions.tf variables.tf data.tf main.tf outputs.tf .gitignore

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      ManagedBy   = "Terraform"
      Environment = var.environment
    }
  }
}

variable "region" {
  description = "AWS region for all resources"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "dev"
}

variable "vpc_name_tag" {
  description = "Name tag of the existing VPC to deploy into — must exist before this config runs"
  type        = string
  default     = "vpc-dev"  # The VPC created by the networking project in Lesson 12
}

# ── EXISTING VPC ─────────────────────────────────────────────────────────────

# Look up an existing VPC by its Name tag
# This VPC was created by the networking project — we do not own it, we reference it
data "aws_vpc" "existing" {
  # filter narrows the query — like a WHERE clause
  # tag:Name is the AWS filter key for the Name tag
  filter {
    name   = "tag:Name"
    values = [var.vpc_name_tag]  # Match the VPC whose Name tag equals this variable
  }
}

# ── SUBNETS IN THE EXISTING VPC ───────────────────────────────────────────────

# Look up all public subnets in the existing VPC
# aws_subnets (plural) returns a list of IDs matching all filters
data "aws_subnets" "public" {
  # Filter 1 — only subnets in the VPC we found above
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.existing.id]  # Reference the data source result
  }

  # Filter 2 — only subnets tagged as public tier
  # Both filters must match — they are ANDed together
  filter {
    name   = "tag:Tier"
    values = ["public"]
  }
}

# ── AVAILABILITY ZONES ────────────────────────────────────────────────────────

# Returns all available AZs in the current region
# state = "available" excludes AZs that are temporarily unavailable or being deprecated
data "aws_availability_zones" "available" {
  state = "available"
}

# ── CURRENT AWS ACCOUNT ───────────────────────────────────────────────────────

# Returns information about the AWS account Terraform is running as
# Useful for building ARNs and for confirming you are deploying to the right account
data "aws_caller_identity" "current" {}

# ── CURRENT AWS REGION ────────────────────────────────────────────────────────

# Returns the current region — useful when you need the region name in a string
# but do not want to repeat the variable reference everywhere
data "aws_region" "current" {}

# ── DYNAMIC AMI LOOKUP ────────────────────────────────────────────────────────

# Look up the latest Amazon Linux 2 AMI for the current region
# This replaces every hardcoded ami-* ID in the configuration
data "aws_ami" "amazon_linux_2" {
  most_recent = true        # When multiple AMIs match, return the newest
  owners      = ["amazon"]  # Only trust AMIs published by Amazon

  # Filter by the AMI name pattern for Amazon Linux 2 HVM x86_64 with gp2 storage
  # The * wildcard matches the version number that changes with each release
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }

  # Only return machine images — not kernels, ramdisks, or snapshots
  filter {
    name   = "image-type"
    values = ["machine"]
  }

  # HVM virtualisation — required for all modern instance types
  # paravirtual is legacy and not supported by most current instance families
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# Look up the latest Ubuntu 22.04 LTS AMI — Canonical's account ID is 099720109477
data "aws_ami" "ubuntu_22" {
  most_recent = true
  owners      = ["099720109477"]  # Canonical — the publisher of Ubuntu AMIs on AWS

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# Create the secret in Secrets Manager — run this once from your terminal
# This is setup, not Terraform code — you would normally do this in a bootstrap process
aws secretsmanager create-secret \
  --name "acme/dev/db-credentials" \
  --description "Database credentials for the dev environment" \
  --secret-string '{"username":"dbadmin","password":"SuperSecretP@ssw0rd123!"}'

# ── SECRETS MANAGER ──────────────────────────────────────────────────────────

# Step 1 — look up the secret metadata by name
# This returns the ARN and description but NOT the value
data "aws_secretsmanager_secret" "db_credentials" {
  name = "acme/${var.environment}/db-credentials"  # Path-based naming by environment
}

# Step 2 — read the current version of the secret value
# secret_string contains the plaintext JSON — always marked sensitive by Terraform
data "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = data.aws_secretsmanager_secret.db_credentials.id  # Reference step 1
}

# Parse the JSON secret string into individual fields
# jsondecode() converts '{"username":"dbadmin","password":"..."}' into a Terraform object
# sensitive = true prevents these values from appearing in any terminal output
locals {
  db_credentials = jsondecode(
    data.aws_secretsmanager_secret_version.db_credentials.secret_string
  )

  # Individual fields accessed with dot notation after decoding
  db_username = local.db_credentials.username  # "dbadmin"
  db_password = local.db_credentials.password  # The actual password — never printed
}

# Security group — lives in the existing VPC from the data source
resource "aws_security_group" "app" {
  name        = "app-sg-${var.environment}"
  description = "Application security group"
  vpc_id      = data.aws_vpc.existing.id  # VPC ID from data source — not hardcoded

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# EC2 instance — AMI and subnet from data sources, never hardcoded
resource "aws_instance" "app" {
  # Dynamic AMI — always the latest Amazon Linux 2 for the current region
  ami = data.aws_ami.amazon_linux_2.id

  instance_type = "t2.micro"

  # First subnet from the list returned by aws_subnets data source
  subnet_id = data.aws_subnets.public.ids[0]

  vpc_security_group_ids = [aws_security_group.app.id]

  tags = {
    Name      = "app-${var.environment}"
    AmiName   = data.aws_ami.amazon_linux_2.name  # Track which AMI version is running
    AccountId = data.aws_caller_identity.current.account_id  # Tag with AWS account ID
  }

  lifecycle {
    create_before_destroy = true

    # The AMI ID will change every time AWS releases a new version
    # ignore_changes prevents Terraform from replacing the instance on every plan
    # Instances are patched in-place — not replaced on every AMI update
    ignore_changes = [ami]
  }
}

# RDS database — password comes from Secrets Manager via data source
resource "aws_db_instance" "main" {
  identifier        = "appdb-${var.environment}"
  engine            = "postgres"
  engine_version    = "15.3"
  instance_class    = "db.t3.micro"
  allocated_storage = 20

  db_name  = "appdb"
  username = local.db_username  # Parsed from Secrets Manager JSON
  password = local.db_password  # Sensitive — never printed in any output

  # Deploy in the first public subnet — in production use private subnets
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.app.id]

  skip_final_snapshot = true  # For dev — always false in production

  tags = {
    Name = "appdb-${var.environment}"
  }
}

# Subnet group for RDS — requires at least two subnets in different AZs
resource "aws_db_subnet_group" "main" {
  name        = "appdb-subnet-group-${var.environment}"
  description = "Subnet group for RDS in ${var.environment}"

  # Pass all public subnet IDs from the data source
  subnet_ids = data.aws_subnets.public.ids

  tags = {
    Name = "appdb-subnet-group-${var.environment}"
  }
}