An engineer wants to attach a firewall rule to an existing virtual network that another team manages in the same cloud account, without Terraform taking ownership of that network or being able to delete it. How should the engineer reference the network in this configuration?
# The virtual network already exists and is owned by another team.
# This configuration must read its id but never manage it.- ADeclare the network with a resource block and set a lifecycle prevent_destroy flag so Terraform cannot delete it.
- BImport the network into state with a resource block, which lets Terraform read it while leaving it untouched.
- CUse a data block for the network and reference its exported id from the firewall rule resource. Correct
- DHardcode the network id as a string variable, because Terraform cannot reference objects it does not create.
Why A is wrong: A resource block would try to create and own the network, and prevent_destroy only blocks deletion, so Terraform would still attempt to manage it.
Why B is wrong: Importing brings the object under full management by a resource block, which is the opposite of the read-only, unmanaged relationship required here.
Why C is correct: A data block reads an existing object without managing its lifecycle, exposing attributes such as the id for other resources to consume.
Why D is wrong: Terraform can reference external objects through data sources, so hardcoding is unnecessary and forgoes validation that the network actually exists.