Dynamic blocks in ingress rules in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of Terraform plan with dynamic ingress blocks

Given the Terraform snippet below, what will be the number of ingress rules created in the security group after running terraform plan?

Terraform

variable "ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A 3 ingress rules will be created, one for each port 22, 80, and 443

B 1 ingress rule will be created with ports 22, 80, and 443 combined

C No ingress rules will be created because dynamic blocks are invalid here

D An error will occur because the variable ports is not referenced correctly

💡 Hint

Think about how dynamic blocks iterate over lists to create multiple nested blocks.

The dynamic block iterates over the list var.ports and creates one ingress block per port. Since the list has three ports, three ingress rules are created.

❓ Configuration

intermediate

Correct dynamic block syntax for multiple CIDR blocks

You want to create ingress rules for port 8080 but allow access from multiple CIDR blocks dynamically. Which Terraform code snippet correctly uses a dynamic block to achieve this?

A

ingress {
  from_port   = 8080
  to_port     = 8080
  protocol    = "tcp"
  cidr_blocks = var.cidr_blocks
}

B

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ingress.value
  }
}

C

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = [ingress.value]
  }
}

D

dynamic "ingress" {
  for_each = var.cidr_blocks
  content {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

💡 Hint

Remember that cidr_blocks expects a list of strings.

Option C correctly uses a dynamic block to create one ingress rule per CIDR block by wrapping ingress.value in a list. Option C is incorrect because cidr_blocks expects a list, not a string.

❓ Troubleshoot

advanced

Error caused by incorrect dynamic block usage in ingress

What error will Terraform produce when applying the following resource configuration?

Terraform

resource "aws_security_group" "bad_example" {
  name = "bad-example"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ingress.value
    }
  }
}

A No error, configuration applies successfully

B Error: Incorrect attribute value type: cidr_blocks must be a list of strings, but a number was provided

C Error: Dynamic block 'ingress' cannot be used inside aws_security_group

D Error: Missing required argument 'cidr_blocks' in ingress block

💡 Hint

Check the expected type of the cidr_blocks attribute.

The cidr_blocks attribute expects a list of strings. Here, ingress.value is a number (port), so Terraform raises a type error.

🔀 Workflow

advanced

Best workflow to update ingress rules dynamically

You have a Terraform configuration with dynamic ingress blocks based on a variable list of ports. You want to add port 3306 to the list and apply changes safely. What is the best sequence of commands to update your infrastructure?

A

1. Destroy the security group
2. Update variable list
3. Run terraform apply

B

1. Run terraform apply
2. Update variable list to include 3306
3. Run terraform plan

C

1. Update variable list to include 3306
2. Run terraform apply without plan
3. Verify changes manually

D

1. Update variable list to include 3306
2. Run terraform plan
3. Review changes
4. Run terraform apply

💡 Hint

Think about safe infrastructure changes with Terraform.

Updating the variable, then running terraform plan to preview changes before applying is the safest and recommended workflow.

🧠 Conceptual

expert

Why use dynamic blocks for ingress rules in Terraform?

Which of the following is the main advantage of using dynamic blocks for ingress rules in Terraform security groups?

A They allow creating multiple ingress rules based on variable input without repeating code blocks

B They improve Terraform apply speed by parallelizing rule creation

C They automatically detect open ports on the server and create rules accordingly

D They replace the need for provider plugins in Terraform

💡 Hint

Think about code reuse and flexibility in Terraform configurations.

Dynamic blocks let you generate multiple nested blocks from a list or map variable, reducing repetition and making configurations flexible.