HCL, providers, resources, and data

Blocks you will see every day

terraform sets the required version and providers. provider configures one plugin. resource declares an object. data reads an existing object. Arguments use = and blocks use braces. terraform fmt rewrites spacing. It does not check whether AWS will accept the values.

terraform validate checks syntax and references. It does not prove the cloud account allows the change. Only a plan against that account, or a test you wrote, goes further.

Init downloads providers

terraform init reads the lock file if you have one, downloads providers, and configures the backend. Commit .terraform.lock.hcl so the next machine does not silently pick a different provider build. Do not commit the .terraform directory or a state file full of ids.

Data sources are not resources

A data source looks up something that already exists, such as an AMI or a network. It does not create it. If the object is gone, the plan fails. That is different from a resource, which Terraform would offer to create.

Lab: a local resource with no cloud account

This uses terraform_data, which ships with Terraform, so plan can run without AWS keys. The required_version floor is a hint. If your binary is older, read the error and install a newer Terraform or skip to the version lesson.

cat > main.tf <<'EOF'
terraform {
  required_version = ">= 1.7.0"
}

resource "terraform_data" "note" {
  input = "hello from the lab"
}

output "note" {
  value = terraform_data.note.output
}
EOF
terraform fmt
terraform init
terraform validate

Mark lesson complete

Concept summary

• Resources are managed. Data sources are reads.
• fmt and validate do not change the cloud.
• Commit the provider lock file, not the state secrets.

Knowledge check

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.

• Resources
• Data sources
• Provider requirements