Dynamic block syntax in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Understanding dynamic block output count

Given the following Terraform snippet using a dynamic block, how many ingress blocks will be created in the resulting resource?

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = ["80", "443"]
    content {
      from_port   = tonumber(ingress.value)
      to_port     = tonumber(ingress.value)
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A 1

B 0

C 2

D 3

💡 Hint

Count the number of items in the for_each list.

The dynamic block iterates over the list ["80", "443"], creating one ingress block per item, so 2 blocks total.

❓ service_behavior

intermediate

Effect of empty for_each in dynamic block

What happens when a dynamic block's for_each expression evaluates to an empty list in Terraform?

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "egress" {
    for_each = []
    content {
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A Terraform creates one egress block with default values.

B Terraform creates no egress blocks inside the resource.

C Terraform creates an egress block with null values.

D Terraform throws a syntax error due to empty for_each.

💡 Hint

Think about what an empty list means for iteration.

An empty for_each means no iterations, so no blocks are created inside the resource.

❓ Architecture

advanced

Dynamic block usage for multiple nested blocks

You want to create an AWS security group with multiple ingress rules, each having multiple cidr_blocks. Which dynamic block structure correctly nests the cidr_blocks inside each ingress rule?

A

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

B

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    dynamic "cidr_blocks" {
      for_each = ingress.value.cidr_blocks
      content {
        cidr_block = cidr_blocks.value
      }
    }
  }
}

C

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks[0]
  }
}

D

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = ingress.value.port
    to_port = ingress.value.port
    protocol = ingress.value.protocol
    cidr_blocks = [for c in ingress.value.cidr_blocks : c]
  }
}

💡 Hint

Remember that cidr_blocks is a list attribute, not a nested block.

The cidr_blocks attribute accepts a list of strings directly. Using a dynamic block inside ingress for cidr_blocks is invalid syntax.

❓ security

advanced

Security risk of incorrect dynamic block usage

If a dynamic block for ingress rules in a security group mistakenly uses a static cidr_blocks value instead of iterating over a variable list, what is the likely security impact?

A The security group will have no ingress rules, blocking all traffic.

B Terraform will fail to apply due to a syntax error in the dynamic block.

C The security group will allow traffic from all IPs, creating a security risk.

D The security group will allow traffic only from the static CIDR block, potentially blocking needed access.

💡 Hint

Consider what happens if the dynamic block does not iterate over all intended CIDRs.

Using a static CIDR means only that IP range is allowed, which may block legitimate traffic if multiple CIDRs were intended.

✅ Best Practice

expert

Optimizing dynamic blocks for maintainability

Which approach best improves maintainability when using dynamic blocks to create multiple similar nested blocks in Terraform?

A Use a single dynamic block with a well-structured variable map containing all nested block data.

B Write multiple static blocks manually for each nested block to avoid complexity.

C Use nested dynamic blocks with hardcoded values inside each content block.

D Avoid dynamic blocks and use count with conditional expressions instead.

💡 Hint

Think about how to keep code DRY and easy to update.

Using a single dynamic block with a structured variable map allows easy updates and reduces code duplication.