Variable validation rules in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the output of a variable validation failure

Given this Terraform variable with validation, what will happen if you provide the value "test"?

variable "env" {
  type = string
  validation {
    condition     = contains(["prod", "dev", "stage"], var.env)
    error_message = "The environment must be one of: prod, dev, stage."
  }
}

A Terraform plan will fail with the error: The environment must be one of: prod, dev, stage.

B Terraform plan will succeed and use the value "test".

C Terraform plan will ignore the validation and warn but continue.

D Terraform plan will fail with a syntax error.

💡 Hint

Think about what happens when a variable value does not meet the validation condition.

Terraform variable validation stops the plan if the condition is false. Since "test" is not in the allowed list, it fails with the specified error message.

❓ service_behavior

intermediate

Determine the effect of a numeric variable validation rule

Consider this Terraform variable:

variable "instance_count" {
  type = number
  default = 3
  validation {
    condition     = var.instance_count >= 1 && var.instance_count <= 5
    error_message = "Instance count must be between 1 and 5."
  }
}

What happens if you set instance_count = 6 in your Terraform configuration?

A Terraform apply will fail with the error: Instance count must be between 1 and 5.

B Terraform apply will succeed and create 6 instances.

C Terraform apply will ignore the validation and create 6 instances.

D Terraform apply will fail with a type error.

💡 Hint

Validation conditions must be true for the plan to succeed.

The validation condition requires the instance count to be between 1 and 5 inclusive. Setting it to 6 violates this, causing Terraform to fail with the error message.

❓ Architecture

advanced

Choose the correct validation for a CIDR block variable

You want to validate a variable vpc_cidr to ensure it is a valid CIDR block in Terraform. Which validation condition correctly checks this?

A condition = length(var.vpc_cidr) > 0

B condition = var.vpc_cidr != ""

C condition = var.vpc_cidr matches "^\d+\.\d+\.\d+\.\d+/\d+$"

D condition = can(cidrhost(var.vpc_cidr, 0))

💡 Hint

Terraform has built-in functions to test CIDR validity.

The can() function tests if cidrhost() can parse the CIDR block. This is a reliable way to validate CIDR format.

❓ security

advanced

Identify the security risk of missing variable validation

What is a potential security risk if you do NOT use validation rules on a Terraform variable that accepts a list of IP addresses for firewall rules?

A Terraform will automatically block invalid IPs, so no risk exists.

B Invalid or malicious IP addresses could be allowed, opening unintended network access.

C The variable will default to an empty list, causing no firewall rules to be created.

D Terraform will fail to apply the configuration due to missing validation.

💡 Hint

Think about what happens if bad input is accepted without checks.

Without validation, users can input incorrect or harmful IP addresses, potentially exposing resources to unauthorized access.

✅ Best Practice

expert

Select the best validation rule for a variable that must be a non-empty list of strings

You have a Terraform variable allowed_users that must be a list of strings and cannot be empty. Which validation block enforces this correctly?

A

validation {
  condition     = length(var.allowed_users) >= 0
  error_message = "allowed_users must be a list."
}

B

validation {
  condition     = var.allowed_users != []
  error_message = "allowed_users cannot be empty."
}

C

validation {
  condition     = length(var.allowed_users) > 0 && alltrue([for u in var.allowed_users : can(regex("^[a-zA-Z0-9_-]+$", u))])
  error_message = "allowed_users must be a non-empty list of valid usernames."
}

D

validation {
  condition     = alltrue([for u in var.allowed_users : length(u) > 0])
  error_message = "allowed_users must contain non-empty strings."
}

💡 Hint

Check both non-empty list and string format in the condition.

Option C checks that the list is not empty and that every string matches a username pattern. Other options miss one or both checks.

Practice

1. What is the main purpose of variable validation rules in Terraform?

easy

A. To speed up the Terraform apply process

B. To automatically fix errors in the Terraform code

C. To create new variables dynamically during runtime

D. To check if input values meet specific conditions before applying configuration

Solution

1. Step 1: Understand variable validation role

   Variable validation rules ensure inputs are correct before Terraform uses them.

2. Step 2: Identify the purpose

   They check conditions and show errors if inputs are invalid, preventing mistakes.

3. Final Answer:

   To check if input values meet specific conditions before applying configuration -> Option D

4. Quick Check:

   Validation checks inputs = C [OK]

Hint: Validation rules check inputs before use to avoid errors [OK]

Common Mistakes:

• Thinking validation fixes errors automatically
• Confusing validation with variable creation
• Assuming validation speeds up apply

2. Which of the following is the correct syntax to add a validation rule for a variable in Terraform?

easy

A. variable "name" { validation { condition = length(var.name) > 3 error_message = "Name too short" } }

B. variable "name" { validate { condition = length(var.name) > 3 message = "Name too short" } }

C. variable "name" { validation_rule { check = length(var.name) > 3 error = "Name too short" } }

D. variable "name" { validate_rule { condition = length(var.name) > 3 error_message = "Name too short" } }

Solution

1. Step 1: Recall Terraform variable validation syntax

   Terraform uses validation block inside variable with condition and error_message.

2. Step 2: Match syntax with options

   variable "name" { validation { condition = length(var.name) > 3 error_message = "Name too short" } } matches correct keywords and structure exactly.

3. Final Answer:

   variable "name" { validation { condition = length(var.name) > 3 error_message = "Name too short" } } -> Option A

4. Quick Check:

   Correct keywords: validation, condition, error_message = A [OK]

Hint: Look for 'validation' block with 'condition' and 'error_message' keys [OK]

Common Mistakes:

• Using 'validate' instead of 'validation'
• Using wrong keys like 'message' or 'error'
• Incorrect block names like 'validation_rule'

3. Given this variable definition, what happens if the input is "ab"?

variable "username" {
  type = string
  validation {
    condition = length(var.username) >= 3
    error_message = "Username must be at least 3 characters"
  }
}

medium

A. Terraform apply ignores the validation and warns only

B. Terraform apply succeeds and uses "ab" as username

C. Terraform apply fails with error: Username must be at least 3 characters

D. Terraform apply replaces "ab" with default username

Solution

1. Step 1: Check validation condition

   The condition requires username length >= 3.

2. Step 2: Evaluate input "ab" length

   "ab" length is 2, which is less than 3, so condition fails.

3. Final Answer:

   Terraform apply fails with error: Username must be at least 3 characters -> Option C

4. Quick Check:

   Input length < 3 triggers error = A [OK]

Hint: Check if input meets condition; if not, apply fails with error [OK]

Common Mistakes:

• Assuming apply succeeds despite validation failure
• Thinking validation only warns, not errors
• Believing default values replace invalid input

4. Identify the error in this variable validation block:

variable "port" {
  type = number
  validation {
    condition = var.port > 0 && var.port < 65536
    error_message = "Port must be between 1 and 65535"
  }
}

medium

A. Using 'number' type instead of 'number' is invalid

B. Validation condition uses 'var.port' instead of 'self'

C. Error message is missing a period at the end

D. Validation block must be outside the variable block

Solution

1. Step 1: Understand validation condition context

   Inside validation, use self to refer to the variable value, not var.port.

2. Step 2: Identify incorrect usage

   The condition incorrectly uses var.port, which is not best practice.

3. Final Answer:

   Validation condition uses 'var.port' instead of 'self' -> Option B

4. Quick Check:

   Use 'self' in validation condition = B [OK]

Hint: Use 'self' to refer to variable value inside validation [OK]

Common Mistakes:

• Using 'var.variable_name' inside validation condition
• Placing validation block outside variable block
• Ignoring syntax errors in condition

5. You want to validate a list variable so it only accepts lists with exactly 3 strings, each at least 2 characters long. Which validation condition is correct?

hard

A. condition = length(self) == 3 && all([for s in self : length(s) >= 2])

B. condition = length(self) == 3 && all([for s in self : s > 2])

C. condition = length(self) == 3 && alltrue([for s in self : s >= 2])

D. condition = length(self) == 3 && alltrue([for s in self : length(s) >= 2])

Solution

1. Step 1: Check list length condition

   We want exactly 3 items, so length(self) == 3 is correct.

2. Step 2: Validate each string length

   Use all() to ensure all elements satisfy length(s) >= 2.

3. Step 3: Identify correct function and condition

   all() is the modern function; alltrue() is legacy.

4. Final Answer:

   condition = length(self) == 3 && all([for s in self : length(s) >= 2]) -> Option A

5. Quick Check:

   Use 'all' with length checks and list length = D [OK]

Hint: Use 'all' function and 'self' for list validation [OK]

Common Mistakes:

• Using 'alltrue' instead of 'all'
• Comparing strings directly to numbers
• Using 's > 2' instead of 'length(s) >= 2'