Dynamic blocks in security groups in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the output of this Terraform security group with dynamic blocks

Given the following Terraform code snippet, what will be the number of ingress rules created in the security group?

Terraform

variable "ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A No ingress rules created due to syntax error

B 1 ingress rule with ports 22, 80, and 443 combined

C Ingress rules created only for port 22

D 3 ingress rules, one for each port 22, 80, and 443

💡 Hint

Think about how dynamic blocks iterate over lists to create multiple nested blocks.

The dynamic block iterates over the list of ports and creates one ingress block per port. Each block has from_port and to_port set to the current port value, resulting in 3 separate ingress rules.

❓ service_behavior

intermediate

What happens if the dynamic block's for_each is an empty list?

Consider the same Terraform security group code but with variable ports set to an empty list. What will be the behavior after applying?

Terraform

variable "ports" {
  type = list(number)
  default = []
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A One ingress rule with port 0 will be created

B Terraform will throw a runtime error due to empty for_each

C No ingress rules will be created in the security group

D Ingress rules from previous apply will persist unchanged

💡 Hint

What does an empty list mean for dynamic blocks in Terraform?

When for_each is an empty list, the dynamic block creates zero nested blocks. Thus, no ingress rules are created.

❓ Architecture

advanced

Choose the correct Terraform code to create multiple egress rules dynamically

You want to create an AWS security group with multiple egress rules for ports 53 and 123 using dynamic blocks. Which Terraform snippet correctly achieves this?

A

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.value
    to_port     = egress.value
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

B

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.key
    to_port     = egress.key
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

C

dynamic "egress" {
  for_each = {53 = "udp", 123 = "udp"}
  content {
    from_port   = egress.key
    to_port     = egress.key
    protocol    = egress.value
    cidr_blocks = ["0.0.0.0/0"]
  }
}

D

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.value
    to_port     = egress.value
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

💡 Hint

Remember that for_each over a list uses .value for the current item, and protocol must match the port's protocol.

Option A correctly uses for_each over a list and sets from_port and to_port to egress.value. Protocol is udp, matching ports 53 and 123. Option A incorrectly uses egress.key which is invalid for list iteration. Option A uses a map but correctly assigns protocol from value. Option A uses tcp protocol which is incorrect for these ports.

❓ security

advanced

What security risk arises if dynamic blocks in security groups use cidr_blocks = ["0.0.0.0/0"] indiscriminately?

If a Terraform security group uses dynamic blocks to create multiple ingress rules all allowing traffic from 0.0.0.0/0, what is the main security concern?

A The security group allows unrestricted access from any IP, increasing exposure to attacks

B Terraform will block the deployment due to insecure CIDR blocks

C The security group will only allow traffic from the local network

D Dynamic blocks prevent any ingress traffic regardless of CIDR blocks

💡 Hint

Think about what 0.0.0.0/0 means in network terms.

CIDR block 0.0.0.0/0 means all IPv4 addresses. Allowing ingress from this range means anyone on the internet can access the ports, which is a security risk.

✅ Best Practice

expert

Which Terraform pattern best avoids duplication when creating multiple similar ingress rules with dynamic blocks?

You need to create multiple ingress rules with different ports and CIDR blocks. Which approach follows best practice to keep Terraform code clean and maintainable?

A Hardcode all ingress rules inside one dynamic block with a fixed port and CIDR block

B Use a single variable list of objects with port and cidr_block, then a dynamic block iterating over it to create ingress rules

C Use multiple dynamic blocks each iterating over a separate list for ports and CIDR blocks independently

D Write separate ingress blocks manually for each port and CIDR block without dynamic blocks

💡 Hint

Think about how to combine related data to simplify iteration.

Option B uses a list of objects combining port and CIDR block, allowing a single dynamic block to create all ingress rules cleanly. Option B duplicates code and is hard to maintain. Option B risks mismatched iterations. Option B is inflexible and does not support multiple rules.

Practice

1. What is the main purpose of using dynamic blocks in Terraform security groups?

easy

A. To delete all security group rules at once

B. To manually write each security group rule one by one

C. To encrypt security group rules for security

D. To create multiple similar security group rules from a list automatically

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating a block of code multiple times based on a list or map input.

2. Step 2: Apply this to security groups

   In security groups, dynamic blocks help create many similar rules without writing each rule manually.

3. Final Answer:

   To create multiple similar security group rules from a list automatically -> Option D

4. Quick Check:

   Dynamic blocks automate repeated blocks [OK]

Hint: Dynamic blocks repeat code for lists automatically [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Believing dynamic blocks encrypt rules
• Confusing dynamic blocks with manual rule writing

2. Which of the following is the correct syntax to start a dynamic block named ingress in a Terraform security group resource?

easy

A. dynamic ingress {

B. dynamic "ingress" {

C. dynamic ingress() {

D. dynamic "ingress"() {

Solution

1. Step 1: Recall Terraform dynamic block syntax

   Dynamic blocks use the keyword dynamic followed by the block name in quotes and curly braces.

2. Step 2: Match syntax for ingress block

   The correct syntax is dynamic "ingress" { to define a dynamic ingress block.

3. Final Answer:

   dynamic "ingress" { -> Option B

4. Quick Check:

   Dynamic block name must be in quotes [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around block name
• Adding parentheses after block name
• Using incorrect keywords

3. Given the following Terraform snippet, what will be the number of ingress rules created?

variable "ports" {
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

medium

A. 3 ingress rules, one for each port

B. 1 ingress rule with ports 22, 80, and 443 combined

C. No ingress rules created due to syntax error

D. Ingress rules created only for port 22

Solution

1. Step 1: Analyze the for_each expression

   The dynamic block uses for_each = var.ports where ports are [22, 80, 443]. This means it loops 3 times.

2. Step 2: Understand content block creation

   Each iteration creates one ingress rule with from_port and to_port set to the current port value.

3. Final Answer:

   3 ingress rules, one for each port -> Option A

4. Quick Check:

   One rule per list item = 3 rules [OK]

Hint: Count list items for number of dynamic blocks created [OK]

Common Mistakes:

• Thinking all ports combine into one rule
• Assuming syntax error without checking
• Ignoring for_each iteration count

4. Identify the error in this Terraform dynamic block for security group ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port   = rule.value.from
    to_port     = rule.value.to
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. for_each must be a map, not a list

B. Missing quotes around "ingress" in dynamic block

C. Incorrect reference to loop variable; should use ingress.value instead of rule.value

D. cidr_blocks cannot be a list

Solution

1. Step 1: Check loop variable usage inside dynamic block

   Inside a dynamic block named "ingress", the loop variable is ingress, not rule.

2. Step 2: Correct variable reference

   References should be ingress.value.from and ingress.value.to to access current item values.

3. Final Answer:

   Incorrect reference to loop variable; should use ingress.value instead of rule.value -> Option C

4. Quick Check:

   Loop variable matches dynamic block name [OK]

Hint: Loop variable = dynamic block name [OK]

Common Mistakes:

• Using wrong loop variable name
• Omitting quotes around dynamic block name
• Misunderstanding for_each data types

5. You want to create a security group with dynamic ingress rules from a list of maps, but only include rules where enabled is true. Which Terraform code snippet correctly uses a dynamic block with filtering?

variable "rules" {
  default = [
    { from = 22, to = 22, enabled = true },
    { from = 80, to = 80, enabled = false },
    { from = 443, to = 443, enabled = true }
  ]
}

resource "aws_security_group" "filtered" {
  name = "filtered-sg"

  dynamic "ingress" {
    for_each = ???
    content {
      from_port   = ingress.value.from
      to_port     = ingress.value.to
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

hard

A. for_each = [for r in var.rules : r if r.enabled]

B. for_each = var.rules

C. for_each = { for r in var.rules : r.from => r if r.enabled }

D. for_each = filter(var.rules, r => r.enabled)

Solution

1. Step 1: Understand filtering with for expressions

   Terraform uses for expressions with an if condition to filter lists, e.g. [for r in var.rules : r if r.enabled].

2. Step 2: Apply filtered list to for_each

   Using this filtered list in for_each creates dynamic blocks only for enabled rules.

3. Final Answer:

   for_each = [for r in var.rules : r if r.enabled] -> Option A

4. Quick Check:

   Use for expression with if to filter list [OK]

Hint: Filter list with for expression and if condition [OK]

Common Mistakes:

• Using unfiltered list causing unwanted rules
• Trying to use non-existent filter() function
• Using map instead of list for for_each