Reference #

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
}

# Referensi atribut data source:
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id           # String — AMI ID
  instance_type = "t3.micro"
}

resource "aws_launch_template" "web" {
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"

  # Referensi atribut lain dari data source yang sama
  description = "Template menggunakan ${data.aws_ami.ubuntu.name} (${data.aws_ami.ubuntu.creation_date})"
}

# Workspace "networking" menyediakan VPC dan subnet
# Workspace "compute" membaca output dari workspace "networking"

data "terraform_remote_state" "networking" {
  backend = "s3"

  config = {
    bucket = "my-terraform-state"
    key    = "production/networking/terraform.tfstate"
    region = "ap-southeast-1"
  }
}

# Gunakan output dari workspace networking
resource "aws_instance" "app" {
  ami       = data.aws_ami.ubuntu.id
  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]

  vpc_security_group_ids = [
    data.terraform_remote_state.networking.outputs.app_security_group_id
  ]
}

# Atau baca semua subnet sekaligus
resource "aws_autoscaling_group" "app" {
  vpc_zone_identifier = data.terraform_remote_state.networking.outputs.private_subnet_ids
  # ...
}

# SKENARIO: Membaca policy yang baru dibuat untuk menggabungkannya

resource "aws_iam_policy" "s3_read" {
  name   = "s3-read-policy"
  policy = data.aws_iam_policy_document.s3_read.json
}

resource "aws_iam_policy" "cloudwatch_write" {
  name   = "cloudwatch-write-policy"
  policy = data.aws_iam_policy_document.cloudwatch_write.json
}

# Data source ini membaca policy yang baru dibuat di atas
data "aws_iam_policy" "s3_read" {
  name = "s3-read-policy"

  # Tanpa depends_on, data source mungkin di-evaluate sebelum
  # resource aws_iam_policy.s3_read selesai dibuat
  depends_on = [aws_iam_policy.s3_read]
}

# Pola yang lebih umum: hindari situasi ini dengan referensi langsung
# Daripada baca via data source, referensikan resource langsung

resource "aws_iam_role_policy_attachment" "app_s3" {
  role       = aws_iam_role.app.name
  policy_arn = aws_iam_policy.s3_read.arn  # Referensi langsung — lebih bersih
  # Bukan: data.aws_iam_policy.s3_read.arn
}

# POLA 1: Dynamic AMI — selalu gunakan AMI terbaru yang sudah di-test

data "aws_ami" "app" {
  most_recent = true
  owners      = ["self"]  # AMI yang dibuat oleh akun ini sendiri (golden AMI)

  filter {
    name   = "name"
    values = ["app-server-*"]
  }

  filter {
    name   = "tag:Status"
    values = ["tested"]  # Hanya AMI yang sudah lulus testing
  }
}

# POLA 2: Lookup resource yang dikelola tim lain

# Tim networking mengelola VPC dan menandainya dengan tag
data "aws_vpc" "main" {
  tags = {
    Name        = "main-vpc"
    Environment = var.environment
    ManagedBy   = "networking-team"
  }
}

data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Tier = "private"
  }
}

# POLA 3: Lookup berdasarkan naming convention yang konsisten

locals {
  # Naming convention yang disepakati tim: <project>-<env>-<component>
  vpc_name = "${var.project}-${var.environment}-vpc"
}

data "aws_vpc" "main" {
  filter {
    name   = "tag:Name"
    values = [local.vpc_name]
  }
}

# POLA 4: Conditional data source — hanya query jika diperlukan

variable "use_existing_vpc" {
  type    = bool
  default = false
}

data "aws_vpc" "existing" {
  count = var.use_existing_vpc ? 1 : 0

  tags = {
    Name = "existing-vpc"
  }
}

resource "aws_subnet" "app" {
  vpc_id = var.use_existing_vpc ? data.aws_vpc.existing[0].id : aws_vpc.new.id
  # ...
}

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
data "aws_partition" "current" {}

# Gunakan untuk ARN yang portable
resource "aws_iam_role_policy" "app" {
  role = aws_iam_role.app.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = [
        # Portable — tidak hardcode account ID atau region
        "arn:${data.aws_partition.current.partition}:s3:::${var.bucket_name}/*"
      ]
    }]
  })
}

# Tag standar yang menyertakan informasi akun
locals {
  standard_tags = {
    AccountId  = data.aws_caller_identity.current.account_id
    Region     = data.aws_region.current.name
    ManagedBy  = "terraform"
  }
}