The external data source runs a program you name and uses the JSON it prints as data in your configuration. Its own documentation calls it an escape hatch for exceptional cases, so a reviewer should treat every use as code execution during planning.
What it does
You give the data source a program list and an optional query map. Terraform runs the program, passes it the query, and reads a result back. The provider documentation says the mechanism is for situations where a first class provider is not more appropriate, and that its capabilities are limited compared with a true data source.
Why reviewers should care
Data sources are read during planning. An external program therefore runs on whatever machine runs terraform plan, which may be a developer laptop or a CI runner holding cloud credentials. A pull request that adds one is a pull request that adds a script to your pipeline.
The documentation also notes that this approach hurts portability, since it creates dependencies on programs and libraries that may not exist on every operating system, and that Terraform Enterprise does not guarantee any language runtime beyond standard shell utilities.
Review checklist
- What program runs, and where does its source live? A script in the repository is reviewable. A tool fetched at runtime is not.
- What does it read: environment variables, files, network endpoints?
- What credentials does the runner hold when it runs?
- Does the query include values that could carry untrusted input?
- Is there a provider data source that does the same job?
- Is the program pinned, and is its dependency list pinned?
Alternatives
| Need | Try first |
|---|---|
| Read cloud data | The provider's own data source |
| Compute a value | Terraform functions and locals |
| Fetch a file or HTTP response | A purpose built provider data source |
| Run a one off task after create | A provider feature or configuration management |
Practical limits to set
- Allow the external data source only in reviewed modules, and flag it with a code owner rule.
- Run plan in a runner with narrow credentials, since plan executes the program.
- Log what the script does, without printing secrets.
Quick check
Does the external data source run during apply only?
No. As a data source, it can run during planning, so a plan can execute the program.
Is it deprecated?
The documentation describes it as an escape hatch for exceptional situations, not as deprecated.
Can the script output be a secret?
It can be, so mark downstream values sensitive, and remember state may still store them.
Safeguard offers SBOM and dependency scanning and policy gates that can block a pull request on findings, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
