TF-004 Read, generate and modify configuration Practice Question
A team has two resources: an AWS security group and an EC2 instance that uses it. Terraform does not automatically detect the dependency. Which argument should be added to the instance resource?
⚠ Common exam trap
A common mix-up: candidates confuse attribute references (like `.id`) with resource references, or forget that `depends_on` must be a list, leading them to pick options that are syntactically or semantically invalid.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
depends_on = [aws_security_group.sg]
Terraform requires explicit dependency declarations when it cannot infer them from resource references. The `depends_on` argument must be a list of resource references, and `[aws_security_group.sg]` correctly references the security group resource as a single-element list. This ensures Terraform creates the security group before the EC2 instance that depends on it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
depends_on = [aws_security_group.sg.*]
Why it's wrong here
The syntax `depends_on = [aws_security_group.sg.*]` is incorrect because the `depends_on` argument expects a list of *resource addresses*, not a splat expression. Splat expressions (`.*`) are used to iterate over collections of resources or data sources to extract attributes, not to declare a dependency on a single resource or a collection of resources in this context. Terraform's dependency graph mechanism requires explicit resource identifiers for ordering.
- ✗
depends_on = aws_security_group.sg
Why it's wrong here
The declaration `depends_on = aws_security_group.sg` is invalid because the `depends_on` argument in Terraform must always be assigned a *list* of resource addresses, even when specifying only a single dependency. Terraform expects the value to be enclosed in square brackets `[]` to denote a list type. Omitting these brackets results in a type mismatch error, as a single resource address string is not a valid list.
- ✓
depends_on = [aws_security_group.sg]
Why this is correct
This option, `depends_on = [aws_security_group.sg]`, correctly specifies an explicit dependency. It uses the full resource address `aws_security_group.sg` within a list, which is the precise syntax Terraform expects for the `depends_on` argument. This ensures that the `aws_security_group.sg` resource is fully created and available before the resource declaring this dependency is provisioned, correctly ordering operations in the dependency graph.
- ✗
depends_on = [aws_security_group.sg.id]
Why it's wrong here
The syntax `depends_on = [aws_security_group.sg.id]` is incorrect because the `depends_on` argument requires a *resource address* (e.g., `resource_type.resource_name`), not an *attribute reference* (e.g., `resource_type.resource_name.attribute`). While `id` is a valid output attribute of the security group, `depends_on` is designed to establish an ordering relationship between entire resources, not to consume specific output values from them.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.