Count vs for_each decision in Terraform - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Choosing between count and for_each for resource creation

You want to create multiple identical virtual machines in Terraform. You have a list of VM names. Which approach is best to create one resource per VM name?

A Use for_each with a map of VM names as keys to create one resource per name.

B Use for_each with the VM names list converted to a set to create one resource per name.

C Use count with a fixed number and hardcode VM names inside the resource.

D Use count with the length of the VM names list and index into the list inside the resource.

💡 Hint

Think about how Terraform uniquely identifies each resource instance.

Using for_each with a map of VM names as keys allows Terraform to track each resource by its key, making management easier and more stable. Count uses numeric indexes which can cause issues if the list changes.

❓ Configuration

intermediate

Terraform resource creation with count and for_each

Given the following Terraform snippet, what will be the number of resources created?

variable "servers" {
  default = ["app1", "app2", "app3"]
}

resource "aws_instance" "example" {
  count = length(var.servers)
  ami           = "ami-123456"
  instance_type = "t2.micro"
  tags = {
    Name = var.servers[count.index]
  }
}

A An error occurs due to invalid count usage.

B 3 resources, one for each server name in the list.

C 0 resources, because the variable is not referenced correctly.

D 1 resource, because count is not supported with lists.

💡 Hint

Count creates multiple instances based on the number provided.

Count uses the length of the servers list (3), so Terraform creates 3 aws_instance resources, each tagged with the corresponding server name.

❓ Architecture

advanced

Handling resource updates with count vs for_each

You have a Terraform configuration using count to create resources from a list. You remove one item from the list and apply changes. What happens to the resources?

A Terraform keeps all resources unchanged.

B Terraform destroys the resource corresponding to the removed item by matching its index.

C Terraform throws an error because count cannot handle list changes.

D Terraform destroys the last resource in the list regardless of which item was removed.

💡 Hint

Think about how count indexes resources and what happens when list length changes.

Count uses numeric indexes. Removing an item shifts indexes, so Terraform destroys the resource at the end of the list, which may not correspond to the removed item, causing unintended destruction.

❓ security

advanced

Security implications of using for_each with sensitive data

You use for_each to create multiple resources with sensitive variables as keys. What is a potential security risk?

A Terraform automatically encrypts all sensitive data in state files, so no risk exists.

B Using for_each disables sensitive variable masking in logs.

C Sensitive data may appear in Terraform state files as keys, exposing secrets.

D There is no difference in security between count and for_each.

💡 Hint

Consider how Terraform stores resource identifiers in state files.

When sensitive data is used as keys in for_each, those keys appear in plaintext in the state file, potentially exposing secrets. It's best to avoid using sensitive data as keys.

❓ service_behavior

expert

Impact on resource lifecycle when switching from count to for_each

You have a Terraform module using count to create resources. You switch to for_each with a map of resource names. After applying, what is the expected behavior regarding resource replacement?

A Terraform will replace all resources because the resource keys changed from indexes to names.

B Terraform will keep all resources unchanged because count and for_each are interchangeable.

C Terraform will throw an error due to incompatible resource identifiers.

D Terraform will only replace resources whose keys differ between count and for_each.

💡 Hint

Think about how Terraform tracks resources by keys and indexes.

Switching from count (numeric indexes) to for_each (named keys) changes resource identifiers, so Terraform treats them as new resources and replaces all existing ones.

Practice

1. Which Terraform argument should you use when you want to create 3 identical resources without unique identifiers?

easy

A. count = 3

B. for_each = {}

C. for_each = toset(["a", "b", "c"])

D. count = 0

Solution

1. Step 1: Understand the purpose of count

   count creates multiple copies of a resource by number, perfect for identical resources.

2. Step 2: Compare with for_each

   for_each is used when you want unique keys or values to identify each resource, not just copies.

3. Final Answer:

   count = 3 -> Option A

4. Quick Check:

   Simple copies = count [OK]

Hint: Use count for number copies, for_each for unique keys [OK]

Common Mistakes:

• Using for_each when only number copies are needed
• Setting count to zero expecting resources
• Confusing sets with counts

2. Which of the following is the correct syntax to create resources using for_each with a map in Terraform?

easy

A. resource "aws_instance" "example" { for_each = ["a", "b"] }

B. resource "aws_instance" "example" { for_each = "string" }

C. resource "aws_instance" "example" { count = 2 }

D. resource "aws_instance" "example" { for_each = { key1 = "val1", key2 = "val2" } }

Solution

1. Step 1: Identify valid for_each types

   for_each accepts maps or sets, not lists or strings directly.

2. Step 2: Check each option

   resource "aws_instance" "example" { for_each = { key1 = "val1", key2 = "val2" } } uses a map with keys and values, which is valid syntax for for_each.

3. Final Answer:

   resource with for_each map -> Option D

4. Quick Check:

   for_each needs map or set [OK]

Hint: for_each needs map or set, not list or string [OK]

Common Mistakes:

• Using list instead of map/set for for_each
• Confusing count with for_each syntax
• Passing string directly to for_each

3. Given this Terraform snippet:

resource "aws_s3_bucket" "buckets" {
  for_each = { bucket1 = "private", bucket2 = "public-read" }
  bucket = each.key
  acl = each.value
}

What will be the names of the created buckets?

medium

A. ["each.key", "each.value"]

B. ["private", "public-read"]

C. ["bucket1", "bucket2"]

D. No buckets created due to syntax error

Solution

1. Step 1: Understand for_each map keys and values

   The keys are bucket1 and bucket2, values are ACL values.

2. Step 2: Check bucket assignment

   The bucket name is set to each.key, so buckets named "bucket1" and "bucket2" are created.

3. Final Answer:

   ["bucket1", "bucket2"] -> Option C

4. Quick Check:

   Bucket names = map keys [OK]

Hint: for_each keys become resource identifiers [OK]

Common Mistakes:

• Using values as bucket names instead of keys
• Assuming syntax error without checking
• Confusing each.key with each.value

4. You wrote this Terraform resource:

resource "aws_instance" "example" {
  count = length(var.instances)
  name  = var.instances[count.index]
}

But Terraform throws an error about count.index. What is the likely cause?

medium

A. count is used but for_each should be used for maps

B. var.instances is a map, but count expects a list

C. You cannot use count.index inside resource blocks

D. count must be a fixed number, not a variable

Solution

1. Step 1: Identify variable type mismatch

   var.instances is likely a map, but count works with numbers and lists indexed by numbers.

2. Step 2: Choose correct iterator

   For maps, for_each is the correct choice to iterate over keys and values.

3. Final Answer:

   Use for_each for maps, not count -> Option A

4. Quick Check:

   Maps need for_each, not count [OK]

Hint: Use for_each for maps, count for lists [OK]

Common Mistakes:

• Using count.index with maps
• Assuming count must be fixed number
• Ignoring variable data type

5. You want to create multiple AWS IAM users with unique usernames and policies from this map:

users = {
  alice = "admin",
  bob = "read-only",
  carol = "power-user"
}

Which Terraform resource block correctly uses count or for_each to create these users with unique names?

hard

A. resource "aws_iam_user" "user" {
count = length(keys(var.users))
name = keys(var.users)[count.index]
policy = var.users[name]
}

B. resource "aws_iam_user" "user" {
for_each = var.users
name = each.key
policy = each.value
}

C. resource "aws_iam_user" "user" {
count = 3
name = var.users[count.index]
policy = var.users[count.index]
}

D. resource "aws_iam_user" "user" {
for_each = toset(var.users)
name = each.value
policy = each.key
}

Solution

1. Step 1: Analyze data structure

   The users variable is a map with usernames as keys and policies as values.

2. Step 2: Match iteration method

   for_each works well with maps to create uniquely identified resources using keys and values.

3. Step 3: Check each option

   resource "aws_iam_user" "user" {
     for_each = var.users
     name     = each.key
     policy   = each.value
   }

   correctly uses for_each = var.users and assigns name = each.key and policy = each.value.

4. Final Answer:

   Use for_each with map for unique users -> Option B

5. Quick Check:

   Unique keys need for_each [OK]

Hint: Use for_each with maps for unique resource keys [OK]

Common Mistakes:

• Using count with maps incorrectly
• Mixing keys and values in wrong order
• Using toset on maps causing errors