Dynamic blocks in security groups in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the output of this Terraform security group with dynamic blocks

Given the following Terraform code snippet, what will be the number of ingress rules created in the security group?

Terraform

variable "ports" {
  type = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A No ingress rules created due to syntax error

B 1 ingress rule with ports 22, 80, and 443 combined

C Ingress rules created only for port 22

D 3 ingress rules, one for each port 22, 80, and 443

💡 Hint

Think about how dynamic blocks iterate over lists to create multiple nested blocks.

The dynamic block iterates over the list of ports and creates one ingress block per port. Each block has from_port and to_port set to the current port value, resulting in 3 separate ingress rules.

❓ service_behavior

intermediate

What happens if the dynamic block's for_each is an empty list?

Consider the same Terraform security group code but with variable ports set to an empty list. What will be the behavior after applying?

Terraform

variable "ports" {
  type = list(number)
  default = []
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

A One ingress rule with port 0 will be created

B Terraform will throw a runtime error due to empty for_each

C No ingress rules will be created in the security group

D Ingress rules from previous apply will persist unchanged

💡 Hint

What does an empty list mean for dynamic blocks in Terraform?

When for_each is an empty list, the dynamic block creates zero nested blocks. Thus, no ingress rules are created.

❓ Architecture

advanced

Choose the correct Terraform code to create multiple egress rules dynamically

You want to create an AWS security group with multiple egress rules for ports 53 and 123 using dynamic blocks. Which Terraform snippet correctly achieves this?

A

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.value
    to_port     = egress.value
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

B

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.key
    to_port     = egress.key
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

C

dynamic "egress" {
  for_each = {53 = "udp", 123 = "udp"}
  content {
    from_port   = egress.key
    to_port     = egress.key
    protocol    = egress.value
    cidr_blocks = ["0.0.0.0/0"]
  }
}

D

dynamic "egress" {
  for_each = [53, 123]
  content {
    from_port   = egress.value
    to_port     = egress.value
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

💡 Hint

Remember that for_each over a list uses .value for the current item, and protocol must match the port's protocol.

Option A correctly uses for_each over a list and sets from_port and to_port to egress.value. Protocol is udp, matching ports 53 and 123. Option A incorrectly uses egress.key which is invalid for list iteration. Option A uses a map but correctly assigns protocol from value. Option A uses tcp protocol which is incorrect for these ports.

❓ security

advanced

What security risk arises if dynamic blocks in security groups use cidr_blocks = ["0.0.0.0/0"] indiscriminately?

If a Terraform security group uses dynamic blocks to create multiple ingress rules all allowing traffic from 0.0.0.0/0, what is the main security concern?

A The security group allows unrestricted access from any IP, increasing exposure to attacks

B Terraform will block the deployment due to insecure CIDR blocks

C The security group will only allow traffic from the local network

D Dynamic blocks prevent any ingress traffic regardless of CIDR blocks

💡 Hint

Think about what 0.0.0.0/0 means in network terms.

CIDR block 0.0.0.0/0 means all IPv4 addresses. Allowing ingress from this range means anyone on the internet can access the ports, which is a security risk.

✅ Best Practice

expert

Which Terraform pattern best avoids duplication when creating multiple similar ingress rules with dynamic blocks?

You need to create multiple ingress rules with different ports and CIDR blocks. Which approach follows best practice to keep Terraform code clean and maintainable?

A Hardcode all ingress rules inside one dynamic block with a fixed port and CIDR block

B Use a single variable list of objects with port and cidr_block, then a dynamic block iterating over it to create ingress rules

C Use multiple dynamic blocks each iterating over a separate list for ports and CIDR blocks independently

D Write separate ingress blocks manually for each port and CIDR block without dynamic blocks

💡 Hint

Think about how to combine related data to simplify iteration.

Option B uses a list of objects combining port and CIDR block, allowing a single dynamic block to create all ingress rules cleanly. Option B duplicates code and is hard to maintain. Option B risks mismatched iterations. Option B is inflexible and does not support multiple rules.