Dynamic blocks in ingress rules in Terraform - Mini Project: Build & Apply

Dynamic blocks in ingress rules

📖 Scenario: You are managing a cloud infrastructure using Terraform. You need to create a security group that allows multiple ingress rules. Instead of writing each rule manually, you want to use dynamic blocks to generate these rules from a list.

🎯 Goal: Build a Terraform configuration that uses a dynamic block inside a security group resource to create multiple ingress rules from a list of maps.

📋 What You'll Learn

Create a variable called ingress_rules with a list of maps containing from_port, to_port, protocol, and cidr_blocks.

Create a security group resource named example_sg.

Use a dynamic block named ingress inside the security group to generate ingress rules from var.ingress_rules.

Print the security group resource block with the dynamic ingress rules.

💡 Why This Matters

🌍 Real World

Cloud engineers often need to manage security groups with many ingress rules. Using dynamic blocks in Terraform helps automate and simplify this process.

💼 Career

Understanding dynamic blocks in Terraform is essential for infrastructure as code roles, enabling efficient and scalable cloud resource management.

1

Create the ingress rules variable

Create a Terraform variable called ingress_rules with the following list of maps exactly: { from_port = 80, to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] } and { from_port = 443, to_port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }.

Terraform

# Create variable "ingress_rules" with the specified list of maps
# Your code here

Hint

Use a variable block with type = list(object({ ... })) and set the default to the list of maps.

2

Create the security group resource

Create a Terraform resource of type aws_security_group named example_sg with a name set to "example-sg".

Terraform

variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 443, to_port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }
  ]
}

# Create aws_security_group resource named example_sg with name "example-sg"
# Your code here

Hint

Use resource "aws_security_group" "example_sg" { ... } and set the name attribute.

3

Add dynamic ingress rules block

Inside the aws_security_group.example_sg resource, add a dynamic block named ingress that iterates over var.ingress_rules. Use for_each = var.ingress_rules and inside the block set from_port, to_port, protocol, and cidr_blocks using each.value.

Terraform

variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 443, to_port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }
  ]
}

resource "aws_security_group" "example_sg" {
  name = "example-sg"

  # Add dynamic ingress block here
  # Your code here
}

Hint

Use dynamic "ingress" { for_each = var.ingress_rules content { ... } } and access values with ingress.value.

4

Output the security group resource

Add a Terraform output named security_group_id that outputs the ID of the aws_security_group.example_sg resource using value = aws_security_group.example_sg.id.

Terraform

variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 443, to_port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }
  ]
}

resource "aws_security_group" "example_sg" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
}

# Add output for security_group_id
# Your code here

Hint

Use output "security_group_id" { value = aws_security_group.example_sg.id } to show the security group ID.

Practice

1. What is the main purpose of using dynamic blocks in Terraform ingress rules?

easy

A. To define a single static ingress rule

B. To encrypt ingress rule data

C. To delete existing ingress rules automatically

D. To create multiple similar ingress rules without repeating code

Solution

1. Step 1: Understand what dynamic blocks do

   Dynamic blocks allow repeating a block multiple times based on a list or map, avoiding code repetition.

2. Step 2: Apply this to ingress rules

   Ingress rules often need multiple similar blocks; dynamic blocks generate these efficiently.

3. Final Answer:

   To create multiple similar ingress rules without repeating code -> Option D

4. Quick Check:

   Dynamic blocks = multiple similar blocks [OK]

Hint: Dynamic blocks repeat blocks from lists or maps [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Confusing dynamic with static blocks
• Assuming dynamic blocks encrypt data

2. Which of the following is the correct syntax to start a dynamic block named ingress in Terraform?

easy

A. dynamic "ingress" { for_each = var.rules { content { ... } } }

B. dynamic ingress { for_each = var.rules { content { ... } } }

C. dynamic "ingress" { for_each = var.rules content { ... } }

D. dynamic ingress { for_each = var.rules content { ... } }

Solution

1. Step 1: Recall dynamic block syntax

   Dynamic blocks require the block type as a quoted string, e.g., dynamic "ingress".

2. Step 2: Check for correct placement of for_each and content

   for_each is assigned outside braces, and content block is inside the dynamic block.

3. Final Answer:

   dynamic "ingress" { for_each = var.rules content { ... } } -> Option C

4. Quick Check:

   Dynamic block syntax uses quotes and for_each outside braces [OK]

Hint: Use quotes around block type and place for_each before content [OK]

Common Mistakes:

• Omitting quotes around block type
• Placing for_each inside braces incorrectly
• Using braces incorrectly around for_each

3. Given the Terraform snippet:

variable "rules" {
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp" },
    { from_port = 443, to_port = 443, protocol = "tcp" }
  ]
}

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.rules
    content {
      from_port   = each.value.from_port
      to_port     = each.value.to_port
      protocol    = each.value.protocol
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

How many ingress rules will be created?

medium

A. 2

B. 0

C. 1

D. 3

Solution

1. Step 1: Count elements in var.rules

   var.rules contains 2 map elements, each with from_port, to_port, protocol.

2. Step 2: Understand dynamic block behavior

   Dynamic block creates one ingress block per element in var.rules, so 2 ingress blocks.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   List length = 2 ingress rules created [OK]

Hint: Count list items in for_each to find block count [OK]

Common Mistakes:

• Counting only one rule
• Assuming dynamic block creates zero rules
• Miscounting list elements

4. Identify the error in this Terraform dynamic block snippet for ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content = {
    from_port   = each.value.from_port
    to_port     = each.value.to_port
    protocol    = each.value.protocol
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. Incorrect use of '=' after content instead of block

B. Missing quotes around "ingress"

C. for_each should be inside content block

D. cidr_blocks must be a string, not a list

Solution

1. Step 1: Check dynamic block syntax for content

   The content block should be a block, not assigned with '='. Using '=' causes syntax error.

2. Step 2: Verify other parts

   Quotes around "ingress" are present; for_each is correctly outside content; cidr_blocks accepts list.

3. Final Answer:

   Incorrect use of '=' after content instead of block -> Option A

4. Quick Check:

   content is a block, not an assignment [OK]

Hint: Use block syntax for content, not '=' assignment [OK]

Common Mistakes:

• Using '=' after content instead of block braces
• Placing for_each inside content
• Omitting quotes around block type

5. You want to create ingress rules dynamically but only for rules where from_port is greater than 1000. Which Terraform expression correctly filters var.rules for use in a dynamic block's for_each?

hard

A. for_each = [for r in var.rules : r if r.from_port > 1000]

B. for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 }

C. for_each = filter(var.rules, r => r.from_port > 1000)

D. for_each = { for r in var.rules : r.from_port => r if r.from_port > 1000 }

Solution

1. Step 1: Understand for_each type requirements

   for_each expects a map or set of strings; using a map with keys is preferred for dynamic blocks.

2. Step 2: Analyze each option

   A returns a list, which is invalid for for_each in dynamic blocks. B uses r.from_port as key, which may duplicate keys. C uses filter function which is invalid syntax in Terraform. D creates a map with index keys filtered by condition, valid and safe.

3. Final Answer:

   for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 } -> Option B

4. Quick Check:

   for_each needs map with unique keys filtered by condition [OK]

Hint: Use map comprehension with index keys and condition [OK]

Common Mistakes:

• Using list instead of map for for_each
• Using non-unique keys causing errors
• Trying unsupported filter() function