Dynamic block syntax in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Understanding dynamic block output count

Given the following Terraform snippet using a dynamic block, how many ingress blocks will be created in the resulting resource?

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = ["80", "443"]
    content {
      from_port   = tonumber(ingress.value)
      to_port     = tonumber(ingress.value)
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A 1

B 0

C 2

D 3

💡 Hint

Count the number of items in the for_each list.

The dynamic block iterates over the list ["80", "443"], creating one ingress block per item, so 2 blocks total.

❓ service_behavior

intermediate

Effect of empty for_each in dynamic block

What happens when a dynamic block's for_each expression evaluates to an empty list in Terraform?

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "egress" {
    for_each = []
    content {
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A Terraform creates one egress block with default values.

B Terraform creates no egress blocks inside the resource.

C Terraform creates an egress block with null values.

D Terraform throws a syntax error due to empty for_each.

💡 Hint

Think about what an empty list means for iteration.

An empty for_each means no iterations, so no blocks are created inside the resource.

❓ Architecture

advanced

Dynamic block usage for multiple nested blocks

You want to create an AWS security group with multiple ingress rules, each having multiple cidr_blocks. Which dynamic block structure correctly nests the cidr_blocks inside each ingress rule?

A

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

B

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    dynamic "cidr_blocks" {
      for_each = ingress.value.cidr_blocks
      content {
        cidr_block = cidr_blocks.value
      }
    }
  }
}

C

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks[0]
  }
}

D

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = [for c in ingress.value.cidr_blocks : c]
  }
}

💡 Hint

Remember that cidr_blocks is a list attribute, not a nested block.

The cidr_blocks attribute accepts a list of strings directly. Using a dynamic block inside ingress for cidr_blocks is invalid syntax.

❓ security

advanced

Security risk of incorrect dynamic block usage

If a dynamic block for ingress rules in a security group mistakenly uses a static cidr_blocks value instead of iterating over a variable list, what is the likely security impact?

A The security group will have no ingress rules, blocking all traffic.

B Terraform will fail to apply due to a syntax error in the dynamic block.

C The security group will allow traffic from all IPs, creating a security risk.

D The security group will allow traffic only from the static CIDR block, potentially blocking needed access.

💡 Hint

Consider what happens if the dynamic block does not iterate over all intended CIDRs.

Using a static CIDR means only that IP range is allowed, which may block legitimate traffic if multiple CIDRs were intended.

✅ Best Practice

expert

Optimizing dynamic blocks for maintainability

Which approach best improves maintainability when using dynamic blocks to create multiple similar nested blocks in Terraform?

A Use a single dynamic block with a well-structured variable map containing all nested block data.

B Write multiple static blocks manually for each nested block to avoid complexity.

C Use nested dynamic blocks with hardcoded values inside each content block.

D Avoid dynamic blocks and use count with conditional expressions instead.

💡 Hint

Think about how to keep code DRY and easy to update.

Using a single dynamic block with a structured variable map allows easy updates and reduces code duplication.

Practice

1. What is the main purpose of a dynamic block in Terraform?

easy

A. To generate multiple nested blocks from a list or map dynamically

B. To create a new Terraform provider

C. To define variables with default values

D. To execute shell commands during deployment

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating nested blocks based on a collection like a list or map.

2. Step 2: Compare with other options

   Options A, B, and D describe unrelated Terraform features.

3. Final Answer:

   To generate multiple nested blocks from a list or map dynamically -> Option A

4. Quick Check:

   Dynamic block = repeated nested blocks [OK]

Hint: Dynamic blocks repeat nested blocks from lists/maps [OK]

Common Mistakes:

• Confusing dynamic blocks with variable declarations
• Thinking dynamic blocks create providers
• Assuming dynamic blocks run commands

2. Which of the following is the correct syntax to start a dynamic block named ingress in Terraform?

easy

A. dynamic ingress { for_each = var.rules content { ... } }

B. dynamic(ingress) { for_each = var.rules content { ... } }

C. dynamic "ingress" { for_each = var.rules content { ... } }

D. dynamic { ingress for_each = var.rules content { ... } }

Solution

1. Step 1: Recall dynamic block syntax

   The block must be declared as dynamic "block_name" { ... } with quotes around the block name.

2. Step 2: Check each option

   dynamic "ingress" { for_each = var.rules content { ... } } uses correct syntax with quotes and proper structure; others miss quotes or have wrong syntax.

3. Final Answer:

   dynamic "ingress" { for_each = var.rules content { ... } } -> Option C

4. Quick Check:

   Dynamic block syntax requires quotes around block name [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around the block name
• Using parentheses instead of braces
• Placing block name outside dynamic keyword

3. Given this Terraform snippet:

dynamic "tag" {
  for_each = {"env" = "prod", "team" = "devops"}
  content {
    key   = tag.key
    value = tag.value
  }
}

What will be the result in the generated resource configuration?

medium

A. No tag blocks generated because map keys are strings

B. A single tag block with key and value set to the entire map

C. Syntax error due to incorrect for_each usage

D. Two tag blocks with keys "env" and "team" and their values

Solution

1. Step 1: Understand for_each with map in dynamic block

   Using a map with for_each creates one nested block per key-value pair.

2. Step 2: Analyze content block usage

   Inside content, tag.key and tag.value refer to each map entry's key and value, creating two blocks.

3. Final Answer:

   Two tag blocks with keys "env" and "team" and their values -> Option D

4. Quick Check:

   Map for_each creates one block per key-value pair [OK]

Hint: Map in for_each creates one block per key-value pair [OK]

Common Mistakes:

• Thinking only one block is created for whole map
• Confusing key and value references inside content
• Assuming syntax error due to map usage

4. Identify the error in this Terraform dynamic block snippet:

dynamic "egress" {
  for_each = var.egress_rules
  content = {
    from_port = egress.value.from
    to_port   = egress.value.to
  }
}

medium

A. The content block should use braces, not an assignment

B. The variable egress is undefined inside the block

C. Missing quotes around "egress" in dynamic block declaration

D. for_each cannot be used with variables

Solution

1. Step 1: Check dynamic block content syntax

   The content must be a block, not an assignment. It should be content { ... }, not content = { ... }.

2. Step 2: Verify other parts

   Variable egress is valid as the iterator, quotes are present, and for_each can use variables.

3. Final Answer:

   The content block should use braces, not an assignment -> Option A

4. Quick Check:

   content must be a block, not an equals assignment [OK]

Hint: Use content { ... } block, not content = { ... } [OK]

Common Mistakes:

• Writing content as an assignment instead of a block
• Assuming iterator variable is undefined
• Forgetting quotes around dynamic block name

5. You want to create multiple network_interface blocks dynamically in an AWS instance resource using a list of maps with keys device_index and subnet_id. Which dynamic block correctly achieves this?

hard

A. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.value.device_index
subnet_id = network_interface.value.subnet_id
}
}

B. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = each.value.device_index
subnet_id = each.value.subnet_id
}
}

C. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.device_index
subnet_id = network_interface.subnet_id
}
}

D. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.key.device_index
subnet_id = network_interface.key.subnet_id
}
}

Solution

1. Step 1: Identify the iterator variable in dynamic block

   Terraform uses each as the iterator inside dynamic blocks for for_each.

2. Step 2: Check how to access map values

   Use each.value.key_name to access map elements inside content block.

3. Step 3: Evaluate options

   dynamic "network_interface" { for_each = var.interfaces content { device_index = each.value.device_index subnet_id = each.value.subnet_id } } correctly uses each.value.device_index and each.value.subnet_id. Others incorrectly use network_interface or network_interface.key.

4. Final Answer:

   dynamic "network_interface" { for_each = var.interfaces content { device_index = each.value.device_index subnet_id = each.value.subnet_id } } -> Option B

5. Quick Check:

   Use each.value to access map in dynamic block [OK]

Hint: Use each.value inside dynamic content block [OK]

Common Mistakes:

• Using block name as iterator variable
• Using .key instead of .value for map access
• Omitting the each keyword