Dynamic blocks in ingress rules in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a dynamic block for ingress rules in Terraform.

Terraform

dynamic "ingress" {
  for_each = var.ingress_rules
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.[1]
  }
}

Drag options to blanks, or click blank then click option'

Acidr_blocks

Bports

Cprotocols

Drules

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ports' or 'protocols' instead of 'cidr_blocks' causes errors.

Confusing the attribute names inside the dynamic block.

The cidr_blocks attribute specifies the IP ranges allowed in the ingress rule. It must match the variable key used in the ingress value.

2fill in blank

medium

Complete the code to iterate over ingress rules using a dynamic block.

Terraform

resource "aws_security_group" "example" {
  name        = "example"
  description = "Example security group"

  dynamic "ingress" {
    for_each = [1]
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
}

Drag options to blanks, or click blank then click option'

Aaws_security_group.example.ingress

Bvar.egress_rules

Cvar.ingress_rules

Dlocal.ingress_list

Attempts:

3 left

💡 Hint

Common Mistakes

Using egress rules variable instead of ingress rules.

Referencing resource attributes instead of variables.

The for_each must iterate over the variable containing ingress rules, which is var.ingress_rules.

3fill in blank

hard

Fix the error in the dynamic block by completing the missing attribute.

Terraform

dynamic "ingress" {
  for_each = var.ingress_rules
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.[1]
  }
}

Drag options to blanks, or click blank then click option'

Acidr_block

Bblocks

Ccidr

Dcidr_blocks

Attempts:

3 left

💡 Hint

Common Mistakes

Using singular 'cidr_block' causes Terraform to error.

Using incomplete or incorrect attribute names.

The correct attribute name is cidr_blocks (plural), which expects a list of CIDR ranges.

4fill in blank

hard

Fill both blanks to create a dynamic ingress block with a condition to only include rules with protocol 'tcp'.

Terraform

dynamic "ingress" {
  for_each = { for idx, rule in var.ingress_rules : idx => rule if rule.[1] == "[2]" }
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

Drag options to blanks, or click blank then click option'

Aprotocol

Btcp

Cfrom_port

Dudp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'from_port' instead of 'protocol' for filtering.

Using 'udp' instead of 'tcp' when the question asks for TCP rules.

The filter uses protocol to check if it equals tcp, so only TCP ingress rules are included.

5fill in blank

hard

Fill all three blanks to define a dynamic ingress block that filters rules with from_port greater than 1024 and protocol 'udp', and maps the port to 'to_port'.

Terraform

dynamic "ingress" {
  for_each = { for idx, rule in var.ingress_rules : idx => rule if rule.[1] > [2] && rule.[3] == "udp" }
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

Drag options to blanks, or click blank then click option'

Afrom_port

B1024

Cprotocol

Dto_port

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'to_port' instead of 'from_port' for comparison.

Using string '1024' instead of number 1024.

Mixing up protocol attribute names.

The filter checks if from_port is greater than 1024 and if protocol equals 'udp'.

Practice

1. What is the main purpose of using dynamic blocks in Terraform ingress rules?

easy

A. To define a single static ingress rule

B. To encrypt ingress rule data

C. To delete existing ingress rules automatically

D. To create multiple similar ingress rules without repeating code

Solution

1. Step 1: Understand what dynamic blocks do

   Dynamic blocks allow repeating a block multiple times based on a list or map, avoiding code repetition.

2. Step 2: Apply this to ingress rules

   Ingress rules often need multiple similar blocks; dynamic blocks generate these efficiently.

3. Final Answer:

   To create multiple similar ingress rules without repeating code -> Option D

4. Quick Check:

   Dynamic blocks = multiple similar blocks [OK]

Hint: Dynamic blocks repeat blocks from lists or maps [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Confusing dynamic with static blocks
• Assuming dynamic blocks encrypt data

2. Which of the following is the correct syntax to start a dynamic block named ingress in Terraform?

easy

A. dynamic "ingress" { for_each = var.rules { content { ... } } }

B. dynamic ingress { for_each = var.rules { content { ... } } }

C. dynamic "ingress" { for_each = var.rules content { ... } }

D. dynamic ingress { for_each = var.rules content { ... } }

Solution

1. Step 1: Recall dynamic block syntax

   Dynamic blocks require the block type as a quoted string, e.g., dynamic "ingress".

2. Step 2: Check for correct placement of for_each and content

   for_each is assigned outside braces, and content block is inside the dynamic block.

3. Final Answer:

   dynamic "ingress" { for_each = var.rules content { ... } } -> Option C

4. Quick Check:

   Dynamic block syntax uses quotes and for_each outside braces [OK]

Hint: Use quotes around block type and place for_each before content [OK]

Common Mistakes:

• Omitting quotes around block type
• Placing for_each inside braces incorrectly
• Using braces incorrectly around for_each

3. Given the Terraform snippet:

variable "rules" {
  default = [
    { from_port = 80, to_port = 80, protocol = "tcp" },
    { from_port = 443, to_port = 443, protocol = "tcp" }
  ]
}

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.rules
    content {
      from_port   = each.value.from_port
      to_port     = each.value.to_port
      protocol    = each.value.protocol
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

How many ingress rules will be created?

medium

A. 2

B. 0

C. 1

D. 3

Solution

1. Step 1: Count elements in var.rules

   var.rules contains 2 map elements, each with from_port, to_port, protocol.

2. Step 2: Understand dynamic block behavior

   Dynamic block creates one ingress block per element in var.rules, so 2 ingress blocks.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   List length = 2 ingress rules created [OK]

Hint: Count list items in for_each to find block count [OK]

Common Mistakes:

• Counting only one rule
• Assuming dynamic block creates zero rules
• Miscounting list elements

4. Identify the error in this Terraform dynamic block snippet for ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content = {
    from_port   = each.value.from_port
    to_port     = each.value.to_port
    protocol    = each.value.protocol
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. Incorrect use of '=' after content instead of block

B. Missing quotes around "ingress"

C. for_each should be inside content block

D. cidr_blocks must be a string, not a list

Solution

1. Step 1: Check dynamic block syntax for content

   The content block should be a block, not assigned with '='. Using '=' causes syntax error.

2. Step 2: Verify other parts

   Quotes around "ingress" are present; for_each is correctly outside content; cidr_blocks accepts list.

3. Final Answer:

   Incorrect use of '=' after content instead of block -> Option A

4. Quick Check:

   content is a block, not an assignment [OK]

Hint: Use block syntax for content, not '=' assignment [OK]

Common Mistakes:

• Using '=' after content instead of block braces
• Placing for_each inside content
• Omitting quotes around block type

5. You want to create ingress rules dynamically but only for rules where from_port is greater than 1000. Which Terraform expression correctly filters var.rules for use in a dynamic block's for_each?

hard

A. for_each = [for r in var.rules : r if r.from_port > 1000]

B. for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 }

C. for_each = filter(var.rules, r => r.from_port > 1000)

D. for_each = { for r in var.rules : r.from_port => r if r.from_port > 1000 }

Solution

1. Step 1: Understand for_each type requirements

   for_each expects a map or set of strings; using a map with keys is preferred for dynamic blocks.

2. Step 2: Analyze each option

   A returns a list, which is invalid for for_each in dynamic blocks. B uses r.from_port as key, which may duplicate keys. C uses filter function which is invalid syntax in Terraform. D creates a map with index keys filtered by condition, valid and safe.

3. Final Answer:

   for_each = { for idx, r in var.rules : idx => r if r.from_port > 1000 } -> Option B

4. Quick Check:

   for_each needs map with unique keys filtered by condition [OK]

Hint: Use map comprehension with index keys and condition [OK]

Common Mistakes:

• Using list instead of map for for_each
• Using non-unique keys causing errors
• Trying unsupported filter() function