AWS Provider

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/
Admin
The AWS Provider is Terraform's most widely-used provider, offering an industry-standard way to...
Tokens:1,153,872
Snippets:7,308
Trust Score:10
Update:1 day ago
Show doc for...
Tokens:
Raw
### Example including a RDS DB instance

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance_automated_backups_replication

Shows a complete setup with an RDS DB instance, a KMS key in the replica region, and the automated backup replication resource. Uses provider aliases to create resources in different regions.

```hcl
provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  region = "us-west-2"
  alias  = "replica"
}

resource "aws_db_instance" "default" {
  allocated_storage       = 10
  identifier              = "mydb"
  engine                  = "postgres"
  engine_version          = "13.4"
  instance_class          = "db.t3.micro"
  db_name                 = "mydb"
  username                = "masterusername"
  password                = "mustbeeightcharacters"
  backup_retention_period = 7
  storage_encrypted       = true
  skip_final_snapshot     = true
}

resource "aws_kms_key" "default" {
  description = "Encryption key for automated backups"

  provider = aws.replica
}

resource "aws_db_instance_automated_backups_replication" "default" {
  source_db_instance_arn = aws_db_instance.default.arn
  kms_key_id             = aws_kms_key.default.arn

  provider = aws.replica
}
```

--------------------------------

### Example Usage: aws_glue_catalog data source

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/glue_catalog

Defines an aws_glue_catalog data source named 'example' with the required 'name' argument set to 'example'. This retrieves details about the specified Glue catalog.

```hcl
data "aws_glue_catalog" "example" {
  name = "example"
}
```

--------------------------------

### Example Usage: Filter SSM Instances by PlatformTypes

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_instances

Use this data source to get the instance IDs of SSM managed instances. The example filters for instances with PlatformTypes set to Linux.

```hcl
data "aws_ssm_instances" "example" {
  filter {
    name   = "PlatformTypes"
    values = ["Linux"]
  }
}
```

--------------------------------

### Basic aws_launch_configuration Example

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration

Creates an AWS launch configuration using a Canonical Ubuntu AMI and instance type t2.micro. The data source fetches the latest matching AMI.

```hcl
data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_launch_configuration" "as_conf" {
  name          = "web_config"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"
}
```

--------------------------------

### Example Usage of aws_elasticache_user

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elasticache_user

Use this data source to get information about an ElastiCache user by specifying the required user_id argument.

```hcl
data "aws_elasticache_user" "bar" {
  user_id = "example"
}
```

--------------------------------

### Roles filtered by path prefix

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_roles

Filters IAM roles by a path prefix. The example retrieves roles with path starting with '/custom-path'.

```hcl
data "aws_iam_roles" "roles" {
  path_prefix = "/custom-path"
}

```

--------------------------------

### Create AMI with EBS-backed root device

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ami

Creates an aws_ami resource named 'example' with an EBS block device populated from an existing snapshot. Enforces IMDSv2 via imds_support = "v2.0"; remove that line if the application doesn't support it. Use aws_ami_copy to duplicate an existing AMI and aws_ami_launch_permission to share one.

```hcl
# Create an AMI that will start a machine whose root device is backed by
# an EBS volume populated from a snapshot. We assume that such a snapshot
# already exists with the id "snap-xxxxxxxx".
resource "aws_ami" "example" {
  name                = "terraform-example"
  virtualization_type = "hvm"
  root_device_name    = "/dev/xvda"
  imds_support        = "v2.0" # Enforce usage of IMDSv2. You can safely remove this line if your application explicitly doesn't support it.
  ebs_block_device {
    device_name = "/dev/xvda"
    snapshot_id = "snap-xxxxxxxx"
    volume_size = 8
  }
}
```

--------------------------------

### Create an aws_appconfig_deployment resource

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appconfig_deployment

Defines an aws_appconfig_deployment resource named 'example' that references an application, configuration profile, hosted configuration version, deployment strategy, environment, and KMS key. Includes a description and a tag.

```hcl
resource "aws_appconfig_deployment" "example" {
  application_id           = aws_appconfig_application.example.id
  configuration_profile_id = aws_appconfig_configuration_profile.example.configuration_profile_id
  configuration_version    = aws_appconfig_hosted_configuration_version.example.version_number
  deployment_strategy_id   = aws_appconfig_deployment_strategy.example.id
  description              = "My example deployment"
  environment_id           = aws_appconfig_environment.example.environment_id
  kms_key_identifier       = aws_kms_key.example.arn

  tags = {
    Type = "AppConfig Deployment"
  }
}
```

--------------------------------

### Basic Usage of aws_dms_instance_profile

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_instance_profile

Creates a minimal AWS DMS instance profile with only a name. Use this as a starting point for simple setups.

```hcl
resource "aws_dms_instance_profile" "example" {
  name = "example"
}
```

--------------------------------

### Create a resource server with sample-scope

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_resource_server

Extends the basic resource server by adding a scope block with scope_name and scope_description. The user_pool_id references the user pool's id.

```hcl
resource "aws_cognito_user_pool" "pool" {
  name = "pool"
}

resource "aws_cognito_resource_server" "resource" {
  identifier = "https://example.com"
  name       = "example"

  scope {
    scope_name        = "sample-scope"
    scope_description = "a Sample Scope Description"
  }

  user_pool_id = aws_cognito_user_pool.pool.id
}

```

--------------------------------

### Filter Secrets Manager Secrets by Name

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secrets

Use this data source to get the ARNs and names of Secrets Manager secrets matching the specified criteria. The example uses a filter block with name set to "name" and values containing "example".

```hcl
data "aws_secretsmanager_secrets" "example" {
  filter {
    name   = "name"
    values = ["example"]
  }
}
```

--------------------------------

### Basic API Gateway Integration Example

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration

Creates a REST API, resource, method, and a MOCK integration. Demonstrates request_parameters, request_templates with an XML to JSON transformation, and custom cache settings.

```hcl
resource "aws_api_gateway_rest_api" "MyDemoAPI" {
  name        = "MyDemoAPI"
  description = "This is my API for demonstration purposes"
}

resource "aws_api_gateway_resource" "MyDemoResource" {
  rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id
  parent_id   = aws_api_gateway_rest_api.MyDemoAPI.root_resource_id
  path_part   = "mydemoresource"
}

resource "aws_api_gateway_method" "MyDemoMethod" {
  rest_api_id   = aws_api_gateway_rest_api.MyDemoAPI.id
  resource_id   = aws_api_gateway_resource.MyDemoResource.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "MyDemoIntegration" {
  rest_api_id          = aws_api_gateway_rest_api.MyDemoAPI.id
  resource_id          = aws_api_gateway_resource.MyDemoResource.id
  http_method          = aws_api_gateway_method.MyDemoMethod.http_method
  type                 = "MOCK"
  cache_key_parameters = ["method.request.path.param"]
  cache_namespace      = "foobar"
  timeout_milliseconds = 29000

  request_parameters = {
    "integration.request.header.X-Authorization" = "'static'"
  }

  # Transforms the incoming XML request to JSON
  request_templates = {
    "application/xml" = <<EOF
{
   "body" : $input.json('$')
}
EOF
  }
}
```

--------------------------------

### Example Usage: aws_ssoadmin_permission_set

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_permission_set

Retrieves an SSO Permission Set by name using the aws_ssoadmin_instances data source to get the instance ARN. The output 'arn' is then exported.

```hcl
data "aws_ssoadmin_instances" "example" {}

data "aws_ssoadmin_permission_set" "example" {
  instance_arn = tolist(data.aws_ssoadmin_instances.example.arns)[0]
  name         = "Example"
}

output "arn" {
  value = data.aws_ssoadmin_permission_set.example.arn
}
```

--------------------------------

### Configuration Settings Example

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/glue_crawler

Creates a Glue Crawler with a schedule, tags, and a JSON configuration using jsonencode. The configuration sets grouping, crawler output, and version.

```hcl
resource "aws_glue_crawler" "events_crawler" {
  database_name = aws_glue_catalog_database.glue_database.name
  schedule      = "cron(0 1 * * ? *)"
  name          = "events_crawler_${var.environment_name}"
  role          = aws_iam_role.glue_role.arn
  tags          = var.tags

  configuration = jsonencode(
    {
      Grouping = {
        TableGroupingPolicy = "CombineCompatibleSchemas"
      }
      CrawlerOutput = {
        Partitions = { AddOrUpdateBehavior = "InheritFromTable" }
      }
      Version = 1
    }
  )

  s3_target {
    path = "s3://${aws_s3_bucket.data_lake_bucket.bucket}"
  }
}
```

--------------------------------

### Get delegation set by ID

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_delegation_set

Use this data source to retrieve a Route 53 delegation set by its ID. The example shows the required id argument.

```hcl
data "aws_route53_delegation_set" "dset" {
  id = "MQWGHCBFAKEID"
}
```

--------------------------------

### Terraform provider version constraint before upgrade (3.x)

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-4-upgrade

Example of the previous Terraform configuration with a version constraint of '~> 3.74' for the AWS provider. This is the starting point before upgrading to version 4.

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.74"
    }
  }
}

provider "aws" {
  # Configuration options
}
```

--------------------------------

### Example Usage: Create and Stop an EC2 Instance

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_instance_state

This example creates an Ubuntu AMI data source, an EC2 instance, and an aws_ec2_instance_state resource to stop the instance. Note that this resource can interfere with user data processing because AWS does not have an API to determine when user data has finished processing.

```hcl
data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_instance" "test" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"

  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ec2_instance_state" "test" {
  instance_id = aws_instance.test.id
  state       = "stopped"
}
```

--------------------------------

### Users filtered by path prefix

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_users

Filters IAM users by a path prefix. The example uses '/custom-path' to retrieve users whose path starts with that prefix. If not specified, the default is a slash ('/'), which lists all users.

```hcl
data "aws_iam_users" "users" {
  path_prefix = "/custom-path"
}
```

--------------------------------

### Create lifecycle configuration for bucket with versioning

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration

This example creates an S3 bucket with versioning enabled and a lifecycle configuration that includes rules for expiring and transitioning current and noncurrent versions. The lifecycle configuration depends on the versioning resource being enabled first.

```hcl
resource "aws_s3_bucket" "bucket" {
  bucket = "my-bucket"
}

resource "aws_s3_bucket_acl" "bucket_acl" {
  bucket = aws_s3_bucket.bucket.bucket
  acl    = "private"
}

resource "aws_s3_bucket_lifecycle_configuration" "bucket-config" {
  bucket = aws_s3_bucket.bucket.bucket

  rule {
    id = "log"

    expiration {
      days = 90
    }

    filter {
      and {
        prefix = "log/"

        tags = {
          rule      = "log"
          autoclean = "true"
        }
      }
    }

    status = "Enabled"

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 60
      storage_class = "GLACIER"
    }
  }

  rule {
    id = "tmp"

    filter {
      prefix = "tmp/"
    }

    expiration {
      date = "2023-01-13T00:00:00Z"
    }

    status = "Enabled"
  }
}

resource "aws_s3_bucket" "versioning_bucket" {
  bucket = "my-versioning-bucket"
}

resource "aws_s3_bucket_acl" "versioning_bucket_acl" {
  bucket = aws_s3_bucket.versioning_bucket.bucket
  acl    = "private"
}

resource "aws_s3_bucket_versioning" "versioning" {
  bucket = aws_s3_bucket.versioning_bucket.bucket
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "versioning-bucket-config" {
  # Must have bucket versioning enabled first
  depends_on = [aws_s3_bucket_versioning.versioning]

  bucket = aws_s3_bucket.versioning_bucket.bucket

  rule {
    id = "config"

    filter {
      prefix = "config/"
    }

    noncurrent_version_expiration {
      noncurrent_days = 90
    }

    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class   = "STANDARD_IA"
    }

    noncurrent_version_transition {
      noncurrent_days = 60
      storage_class   = "GLACIER"
    }

    status = "Enabled"
  }
}
```

--------------------------------

### Lambda Integration Example

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration

Sets up an API Gateway with a Lambda proxy integration (AWS_PROXY). Includes the Lambda function, permission, and IAM role with an assume role policy.

```hcl
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
data "aws_partition" "current" {}

# API Gateway
resource "aws_api_gateway_rest_api" "api" {
  name = "myapi"
}

resource "aws_api_gateway_resource" "resource" {
  path_part   = "resource"
  parent_id   = aws_api_gateway_rest_api.api.root_resource_id
  rest_api_id = aws_api_gateway_rest_api.api.id
}

resource "aws_api_gateway_method" "method" {
  rest_api_id   = aws_api_gateway_rest_api.api.id
  resource_id   = aws_api_gateway_resource.resource.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "integration" {
  rest_api_id             = aws_api_gateway_rest_api.api.id
  resource_id             = aws_api_gateway_resource.resource.id
  http_method             = aws_api_gateway_method.method.http_method
  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = aws_lambda_function.lambda.invoke_arn
}

# Lambda
resource "aws_lambda_permission" "apigw_lambda" {
  statement_id  = "AllowExecutionFromAPIGateway"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda.function_name
  principal     = "apigateway.amazonaws.com"

  # More: http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html
  source_arn = "arn:${data.aws_partition.current.partition}:execute-api:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.api.id}/*/${aws_api_gateway_method.method.http_method}${aws_api_gateway_resource.resource.path}"
}

resource "aws_lambda_function" "lambda" {
  filename      = "lambda.zip"
  function_name = "mylambda"
  role          = aws_iam_role.role.arn
  handler       = "lambda.lambda_handler"
  runtime       = "python3.12"

  source_code_hash = filebase64sha256("lambda.zip")
}

# IAM
data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "role" {
  name               = "myrole"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}
```

--------------------------------

### Retrieve current IAM account alias with aws_iam_account_alias

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_account_alias

Use this data source to get the account alias for the effective AWS account. The example declares the data source and outputs the account_alias attribute. No arguments are supported.

```hcl
data "aws_iam_account_alias" "current" {}

output "account_alias" {
  value = data.aws_iam_account_alias.current.account_alias
}
```

--------------------------------

### Example Usage: aws_guardduty_publishing_destination

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_publishing_destination

This example creates a GuardDuty publishing destination with an S3 bucket and KMS key. It includes IAM policies for S3 and KMS, a GuardDuty detector, and the publishing destination resource. Note: The bucket and KMS policies are too open for production; refer to AWS documentation for secure policies.

```hcl
data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

data "aws_iam_policy_document" "bucket_pol" {
  statement {
    sid = "Allow PutObject"
    actions = [
      "s3:PutObject"
    ]

    resources = [
      "${aws_s3_bucket.gd_bucket.arn}/*"
    ]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }

  statement {
    sid = "Allow GetBucketLocation"
    actions = [
      "s3:GetBucketLocation"
    ]

    resources = [
      aws_s3_bucket.gd_bucket.arn
    ]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "kms_pol" {

  statement {
    sid = "Allow GuardDuty to encrypt findings"
    actions = [
      "kms:GenerateDataKey"
    ]

    resources = [
      "arn:aws:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:key/*"
    ]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }

  statement {
    sid = "Allow all users to modify/delete key (test only)"
    actions = [
      "kms:*"
    ]

    resources = [
      "arn:aws:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:key/*"
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
  }

}

resource "aws_guardduty_detector" "test_gd" {
  enable = true
}

resource "aws_s3_bucket" "gd_bucket" {
  bucket        = "example"
  force_destroy = true
}

resource "aws_s3_bucket_acl" "gd_bucket_acl" {
  bucket = aws_s3_bucket.gd_bucket.id
  acl    = "private"
}

resource "aws_s3_bucket_policy" "gd_bucket_policy" {
  bucket = aws_s3_bucket.gd_bucket.id
  policy = data.aws_iam_policy_document.bucket_pol.json
}

resource "aws_kms_key" "gd_key" {
  description             = "Temporary key for AccTest of TF"
  deletion_window_in_days = 7
  policy                  = data.aws_iam_policy_document.kms_pol.json
}

resource "aws_guardduty_publishing_destination" "test" {
  detector_id     = aws_guardduty_detector.test_gd.id
  destination_arn = aws_s3_bucket.gd_bucket.arn
  kms_key_arn     = aws_kms_key.gd_key.arn

  depends_on = [
    aws_s3_bucket_policy.gd_bucket_policy,
  ]
}
```

--------------------------------

### Using aws_launch_configuration with Spot Instances

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration

Sets a spot price on the launch configuration to reserve spot instances for the Auto Scaling group. Uses m4.large instance type and create_before_destroy lifecycle.

```hcl
data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_launch_configuration" "as_conf" {
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "m4.large"
  spot_price    = "0.001"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "bar" {
  name                 = "terraform-asg-example"
  launch_configuration = aws_launch_configuration.as_conf.name
}
```

--------------------------------

### Basic Usage of aws_organizations_policy

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_policy

Retrieves an AWS Organizations policy by first getting the organization and policies for a target, then using the policy ID. The policy_id argument is required and starts with 'p-' followed by 8-28 lowercase or uppercase letters, digits, and underscores.

```hcl
data "aws_organizations_organization" "current" {}

data "aws_organizations_policies_for_target" "current" {
  target_id = data.aws_organizations_organization.current.roots[0].id
  filter    = "SERVICE_CONTROL_POLICY"
}
data "aws_organizations_policy" "test" {
  policy_id = data.aws_organizations_policies_for_target.current.policies[0].id
}

```

--------------------------------

### Example Usage: aws_dx_hosted_public_virtual_interface_accepter

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dx_hosted_public_virtual_interface_accepter

Shows the full configuration for accepting a hosted public virtual interface. It defines two providers (creator and accepter), a data source for the accepter's account ID, the creator's virtual interface resource, and the accepter resource with tags.

```hcl
provider "aws" {
  # Creator's credentials.
}

provider "aws" {
  alias = "accepter"

  # Accepter's credentials.
}

data "aws_caller_identity" "accepter" {
  provider = aws.accepter
}

# Creator's side of the VIF
resource "aws_dx_hosted_public_virtual_interface" "creator" {
  connection_id    = "dxcon-zzzzzzzz"
  owner_account_id = data.aws_caller_identity.accepter.account_id

  name           = "vif-foo"
  vlan           = 4094
  address_family = "ipv4"
  bgp_asn        = 65352

  customer_address = "175.45.176.1/30"
  amazon_address   = "175.45.176.2/30"

  route_filter_prefixes = [
    "210.52.109.0/24",
    "175.45.176.0/22",
  ]
}

# Accepter's side of the VIF.
resource "aws_dx_hosted_public_virtual_interface_accepter" "accepter" {
  provider             = aws.accepter
  virtual_interface_id = aws_dx_hosted_public_virtual_interface.creator.id

  tags = {
    Side = "Accepter"
  }
}
```

--------------------------------

### Retrieve descendant accounts with aws_organizations_organizational_unit_descendant_accounts

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organizational_unit_descendant_accounts

Use this data source to get all direct child accounts under a parent organizational unit. The example references the organization's root ID as the parent_id. Requires the aws_organizations_organization data source to obtain the root ID.

```hcl
data "aws_organizations_organization" "org" {}

data "aws_organizations_organizational_unit_descendant_accounts" "accounts" {
  parent_id = data.aws_organizations_organization.org.roots[0].id
}

```

--------------------------------

### Get EBS volume IDs by tag and map to availability zones

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_volumes

This example uses the aws_ebs_volumes data source to find volumes with a specific tag, then uses aws_ebs_volume with for_each to fetch details and output a map of availability zone to volume ID.

```hcl
data "aws_ebs_volumes" "example" {
  tags = {
    VolumeSet = "TestVolumeSet"
  }
}

data "aws_ebs_volume" "example" {
  for_each = data.aws_ebs_volumes.example.ids
  filter {
    name   = "volume-id"
    values = [each.value]
  }
}

output "availability_zone_to_volume_id" {
  value = { for s in data.aws_ebs_volume.example : s.id => s.availability_zone }
}
```

--------------------------------

### Lookup by Filter

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_dhcp_options

Use this data source to retrieve DHCP options by specifying filters. The example filters by key 'domain-name' and value 'example.com'.

```hcl
data "aws_vpc_dhcp_options" "example" {
  filter {
    name   = "key"
    values = ["domain-name"]
  }

  filter {
    name   = "value"
    values = ["example.com"]
  }
}

```

--------------------------------

### Get listener by ARN or by load balancer ARN and port

Source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lb_listener

Example usage showing two ways to retrieve an aws_lb_listener: by listener ARN using a variable, and by load_balancer_arn and port. The first uses the arn argument, the second uses the load_balancer_arn and port arguments.

```hcl
# get listener from listener arn

variable "listener_arn" {
  type = string
}

data "aws_lb_listener" "listener" {
  arn = var.listener_arn
}

# get listener from load_balancer_arn and port

data "aws_lb" "selected" {
  name = "default-public"
}

data "aws_lb_listener" "selected443" {
  load_balancer_arn = data.aws_lb.selected.arn
  port              = 443
}
```
Tokens:
Raw