Dynamic blocks in ingress rules in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of Terraform plan with dynamic ingress blocks

Given the Terraform snippet below, what will be the number of ingress rules created in the security group after running terraform plan?

Terraform

variable "ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A 3 ingress rules will be created, one for each port 22, 80, and 443

B 1 ingress rule will be created with ports 22, 80, and 443 combined

C No ingress rules will be created because dynamic blocks are invalid here

D An error will occur because the variable ports is not referenced correctly

💡 Hint

Think about how dynamic blocks iterate over lists to create multiple nested blocks.

The dynamic block iterates over the list var.ports and creates one ingress block per port. Since the list has three ports, three ingress rules are created.

❓ Configuration

intermediate

Correct dynamic block syntax for multiple CIDR blocks

You want to create ingress rules for port 8080 but allow access from multiple CIDR blocks dynamically. Which Terraform code snippet correctly uses a dynamic block to achieve this?

A

ingress {
  from_port   = 8080
  to_port     = 8080
  protocol    = "tcp"
  cidr_blocks = var.cidr_blocks
}

B

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ingress.value
  }
}

C

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = [ingress.value]
  }
}

D

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

💡 Hint

Remember that cidr_blocks expects a list of strings.

Option C correctly uses a dynamic block to create one ingress rule per CIDR block by wrapping ingress.value in a list. Option C is incorrect because cidr_blocks expects a list, not a string.

❓ Troubleshoot

advanced

Error caused by incorrect dynamic block usage in ingress

What error will Terraform produce when applying the following resource configuration?

Terraform

resource "aws_security_group" "bad_example" {
  name = "bad-example"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ingress.value
    }
  }
}

A No error, configuration applies successfully

B Error: Incorrect attribute value type: cidr_blocks must be a list of strings, but a number was provided

C Error: Dynamic block 'ingress' cannot be used inside aws_security_group

D Error: Missing required argument 'cidr_blocks' in ingress block

💡 Hint

Check the expected type of the cidr_blocks attribute.

The cidr_blocks attribute expects a list of strings. Here, ingress.value is a number (port), so Terraform raises a type error.

🔀 Workflow

advanced

Best workflow to update ingress rules dynamically

You have a Terraform configuration with dynamic ingress blocks based on a variable list of ports. You want to add port 3306 to the list and apply changes safely. What is the best sequence of commands to update your infrastructure?

A

1. Destroy the security group
2. Update variable list
3. Run terraform apply

B

1. Run terraform apply
2. Update variable list to include 3306
3. Run terraform plan

C

1. Update variable list to include 3306
2. Run terraform apply without plan
3. Verify changes manually

D

1. Update variable list to include 3306
2. Run terraform plan
3. Review changes
4. Run terraform apply

💡 Hint

Think about safe infrastructure changes with Terraform.

Updating the variable, then running terraform plan to preview changes before applying is the safest and recommended workflow.

🧠 Conceptual

expert

Why use dynamic blocks for ingress rules in Terraform?

Which of the following is the main advantage of using dynamic blocks for ingress rules in Terraform security groups?

A They allow creating multiple ingress rules based on variable input without repeating code blocks

B They improve Terraform apply speed by parallelizing rule creation

C They automatically detect open ports on the server and create rules accordingly

D They replace the need for provider plugins in Terraform

💡 Hint

Think about code reuse and flexibility in Terraform configurations.

Dynamic blocks let you generate multiple nested blocks from a list or map variable, reducing repetition and making configurations flexible.

Practice

1. What is the main purpose of using dynamic blocks in Terraform ingress rules?

easy

A. To define a single static ingress rule

B. To encrypt ingress rule data

C. To delete existing ingress rules automatically

D. To create multiple similar ingress rules without repeating code

Solution

1. Step 1: Understand what dynamic blocks do

   Dynamic blocks allow repeating a block multiple times based on a list or map, avoiding code repetition.

2. Step 2: Apply this to ingress rules

   Ingress rules often need multiple similar blocks; dynamic blocks generate these efficiently.

3. Final Answer:

   To create multiple similar ingress rules without repeating code -> Option D

4. Quick Check:

   Dynamic blocks = multiple similar blocks [OK]

Hint: Dynamic blocks repeat blocks from lists or maps [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Confusing dynamic with static blocks
• Assuming dynamic blocks encrypt data

2. Which of the following is the correct syntax to start a dynamic block named ingress in Terraform?

easy

A. dynamic "ingress" { for_each = var.rules { content { ... } } }

B. dynamic ingress { for_each = var.rules { content { ... } } }

C. dynamic "ingress" { for_each = var.rules content { ... } }

D. dynamic ingress { for_each = var.rules content { ... } }

Solution

1. Step 1: Recall dynamic block syntax

   Dynamic blocks require the block type as a quoted string, e.g., dynamic "ingress".

2. Step 2: Check for correct placement of for_each and content

   for_each is assigned outside braces, and content block is inside the dynamic block.

3. Final Answer:

   dynamic "ingress" { for_each = var.rules content { ... } } -> Option C

4. Quick Check:

   Dynamic block syntax uses quotes and for_each outside braces [OK]

Hint: Use quotes around block type and place for_each before content [OK]

Common Mistakes:

• Omitting quotes around block type
• Placing for_each inside braces incorrectly
• Using braces incorrectly around for_each

3. Given the Terraform snippet:

variable "rules" {
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp" },
    { from_port = 443, to_port = 443, protocol = "tcp" }
  ]
}

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.rules
    content {
      from_port   = each.value.from_port
      to_port     = each.value.to_port
      protocol    = each.value.protocol
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

How many ingress rules will be created?

medium

A. 2

B. 0

C. 1

D. 3

Solution

1. Step 1: Count elements in var.rules

   var.rules contains 2 map elements, each with from_port, to_port, protocol.

2. Step 2: Understand dynamic block behavior

   Dynamic block creates one ingress block per element in var.rules, so 2 ingress blocks.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   List length = 2 ingress rules created [OK]

Hint: Count list items in for_each to find block count [OK]

Common Mistakes:

• Counting only one rule
• Assuming dynamic block creates zero rules
• Miscounting list elements

4. Identify the error in this Terraform dynamic block snippet for ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content = {
    from_port   = each.value.from_port
    to_port     = each.value.to_port
    protocol    = each.value.protocol
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. Incorrect use of '=' after content instead of block

B. Missing quotes around "ingress"

C. for_each should be inside content block

D. cidr_blocks must be a string, not a list

Solution

1. Step 1: Check dynamic block syntax for content

   The content block should be a block, not assigned with '='. Using '=' causes syntax error.

2. Step 2: Verify other parts

   Quotes around "ingress" are present; for_each is correctly outside content; cidr_blocks accepts list.

3. Final Answer:

   Incorrect use of '=' after content instead of block -> Option A

4. Quick Check:

   content is a block, not an assignment [OK]

Hint: Use block syntax for content, not '=' assignment [OK]

Common Mistakes:

• Using '=' after content instead of block braces
• Placing for_each inside content
• Omitting quotes around block type

5. You want to create ingress rules dynamically but only for rules where from_port is greater than 1000. Which Terraform expression correctly filters var.rules for use in a dynamic block's for_each?

hard

A. for_each = [for r in var.rules : r if r.from_port > 1000]

B. for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 }

C. for_each = filter(var.rules, r => r.from_port > 1000)

D. for_each = { for r in var.rules : r.from_port => r if r.from_port > 1000 }

Solution

1. Step 1: Understand for_each type requirements

   for_each expects a map or set of strings; using a map with keys is preferred for dynamic blocks.

2. Step 2: Analyze each option

   A returns a list, which is invalid for for_each in dynamic blocks. B uses r.from_port as key, which may duplicate keys. C uses filter function which is invalid syntax in Terraform. D creates a map with index keys filtered by condition, valid and safe.

3. Final Answer:

   for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 } -> Option B

4. Quick Check:

   for_each needs map with unique keys filtered by condition [OK]

Hint: Use map comprehension with index keys and condition [OK]

Common Mistakes:

• Using list instead of map for for_each
• Using non-unique keys causing errors
• Trying unsupported filter() function