Dynamic block syntax in Terraform - Mini Project: Build & Apply

Terraform Dynamic Block Syntax

📖 Scenario: You are setting up a Terraform configuration to create an AWS security group. You want to allow multiple ingress rules, but you want to use a dynamic block to define these rules based on a list of ports.

🎯 Goal: Build a Terraform configuration that uses a dynamic block to create multiple ingress rules inside an AWS security group resource.

📋 What You'll Learn

Create a variable list of ports called allowed_ports with values 22, 80, and 443

Create an AWS security group resource named example_sg

Use a dynamic block named ingress inside the security group resource

Each ingress rule should allow TCP traffic on the ports from allowed_ports from any IP

💡 Why This Matters

🌍 Real World

Dynamic blocks help manage multiple similar resource blocks efficiently, such as multiple firewall rules, without repeating code.

💼 Career

Understanding dynamic blocks is essential for Terraform users to write clean, scalable infrastructure as code, a key skill for cloud engineers and DevOps professionals.

1

Create the allowed_ports variable

Create a Terraform variable called allowed_ports of type list(number) with the exact values [22, 80, 443].

Terraform

# Your code here

Hint

Use variable "allowed_ports" with type = list(number) and set default to [22, 80, 443].

2

Create the AWS security group resource

Create a Terraform resource of type aws_security_group named example_sg with a name attribute set to "example-sg".

Terraform

variable "allowed_ports" {
  type = list(number)
  default = [22, 80, 443]
}

# Your code here

Hint

Use resource "aws_security_group" "example_sg" and set name = "example-sg".

3

Add the dynamic block for ingress rules

Inside the aws_security_group.example_sg resource, add a dynamic block named ingress that iterates over var.allowed_ports. For each port, create an ingress rule with from_port and to_port set to the port number, protocol set to "tcp", and cidr_blocks set to ["0.0.0.0/0"].

Terraform

variable "allowed_ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example_sg" {
  name = "example-sg"

  # Your code here
}

Hint

Use dynamic "ingress" with for_each = var.allowed_ports. Inside content, set from_port and to_port to ingress.value.

4

Complete the security group with description

Add a description attribute to the aws_security_group.example_sg resource with the exact value "Example security group with dynamic ingress rules".

Terraform

variable "allowed_ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example_sg" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.allowed_ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

  # Your code here
}

Hint

Add description = "Example security group with dynamic ingress rules" inside the resource block.

Practice

1. What is the main purpose of a dynamic block in Terraform?

easy

A. To generate multiple nested blocks from a list or map dynamically

B. To create a new Terraform provider

C. To define variables with default values

D. To execute shell commands during deployment

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating nested blocks based on a collection like a list or map.

2. Step 2: Compare with other options

   Options A, B, and D describe unrelated Terraform features.

3. Final Answer:

   To generate multiple nested blocks from a list or map dynamically -> Option A

4. Quick Check:

   Dynamic block = repeated nested blocks [OK]

Hint: Dynamic blocks repeat nested blocks from lists/maps [OK]

Common Mistakes:

• Confusing dynamic blocks with variable declarations
• Thinking dynamic blocks create providers
• Assuming dynamic blocks run commands

2. Which of the following is the correct syntax to start a dynamic block named ingress in Terraform?

easy

A. dynamic ingress { for_each = var.rules content { ... } }

B. dynamic(ingress) { for_each = var.rules content { ... } }

C. dynamic "ingress" { for_each = var.rules content { ... } }

D. dynamic { ingress for_each = var.rules content { ... } }

Solution

1. Step 1: Recall dynamic block syntax

   The block must be declared as dynamic "block_name" { ... } with quotes around the block name.

2. Step 2: Check each option

   dynamic "ingress" { for_each = var.rules content { ... } } uses correct syntax with quotes and proper structure; others miss quotes or have wrong syntax.

3. Final Answer:

   dynamic "ingress" { for_each = var.rules content { ... } } -> Option C

4. Quick Check:

   Dynamic block syntax requires quotes around block name [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around the block name
• Using parentheses instead of braces
• Placing block name outside dynamic keyword

3. Given this Terraform snippet:

dynamic "tag" {
  for_each = {"env" = "prod", "team" = "devops"}
  content {
    key   = tag.key
    value = tag.value
  }
}

What will be the result in the generated resource configuration?

medium

A. No tag blocks generated because map keys are strings

B. A single tag block with key and value set to the entire map

C. Syntax error due to incorrect for_each usage

D. Two tag blocks with keys "env" and "team" and their values

Solution

1. Step 1: Understand for_each with map in dynamic block

   Using a map with for_each creates one nested block per key-value pair.

2. Step 2: Analyze content block usage

   Inside content, tag.key and tag.value refer to each map entry's key and value, creating two blocks.

3. Final Answer:

   Two tag blocks with keys "env" and "team" and their values -> Option D

4. Quick Check:

   Map for_each creates one block per key-value pair [OK]

Hint: Map in for_each creates one block per key-value pair [OK]

Common Mistakes:

• Thinking only one block is created for whole map
• Confusing key and value references inside content
• Assuming syntax error due to map usage

4. Identify the error in this Terraform dynamic block snippet:

dynamic "egress" {
  for_each = var.egress_rules
  content = {
    from_port = egress.value.from
    to_port   = egress.value.to
  }
}

medium

A. The content block should use braces, not an assignment

B. The variable egress is undefined inside the block

C. Missing quotes around "egress" in dynamic block declaration

D. for_each cannot be used with variables

Solution

1. Step 1: Check dynamic block content syntax

   The content must be a block, not an assignment. It should be content { ... }, not content = { ... }.

2. Step 2: Verify other parts

   Variable egress is valid as the iterator, quotes are present, and for_each can use variables.

3. Final Answer:

   The content block should use braces, not an assignment -> Option A

4. Quick Check:

   content must be a block, not an equals assignment [OK]

Hint: Use content { ... } block, not content = { ... } [OK]

Common Mistakes:

• Writing content as an assignment instead of a block
• Assuming iterator variable is undefined
• Forgetting quotes around dynamic block name

5. You want to create multiple network_interface blocks dynamically in an AWS instance resource using a list of maps with keys device_index and subnet_id. Which dynamic block correctly achieves this?

hard

A. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.value.device_index
subnet_id = network_interface.value.subnet_id
}
}

B. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = each.value.device_index
subnet_id = each.value.subnet_id
}
}

C. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.device_index
subnet_id = network_interface.subnet_id
}
}

D. dynamic "network_interface" {
for_each = var.interfaces
content {
device_index = network_interface.key.device_index
subnet_id = network_interface.key.subnet_id
}
}

Solution

1. Step 1: Identify the iterator variable in dynamic block

   Terraform uses each as the iterator inside dynamic blocks for for_each.

2. Step 2: Check how to access map values

   Use each.value.key_name to access map elements inside content block.

3. Step 3: Evaluate options

   dynamic "network_interface" { for_each = var.interfaces content { device_index = each.value.device_index subnet_id = each.value.subnet_id } } correctly uses each.value.device_index and each.value.subnet_id. Others incorrectly use network_interface or network_interface.key.

4. Final Answer:

   dynamic "network_interface" { for_each = var.interfaces content { device_index = each.value.device_index subnet_id = each.value.subnet_id } } -> Option B

5. Quick Check:

   Use each.value to access map in dynamic block [OK]

Hint: Use each.value inside dynamic content block [OK]

Common Mistakes:

• Using block name as iterator variable
• Using .key instead of .value for map access
• Omitting the each keyword