Dynamic blocks in security groups in Terraform - Mini Project: Build & Apply

Dynamic blocks in security groups

📖 Scenario: You are setting up a cloud network security group to control access to your servers. You want to allow multiple ports for incoming traffic, but the list of ports might change. Using dynamic blocks in Terraform helps you manage this easily.

🎯 Goal: Create a Terraform configuration for an AWS security group that uses a dynamic block to add multiple ingress rules for specified ports.

📋 What You'll Learn

Create a variable with a list of ports

Define an AWS security group resource

Use a dynamic block to add ingress rules for each port in the list

Set the protocol to TCP and allow traffic from anywhere (0.0.0.0/0)

💡 Why This Matters

🌍 Real World

Managing security groups with dynamic blocks helps automate and simplify cloud network security configurations, especially when the allowed ports change frequently.

💼 Career

Cloud engineers and DevOps professionals often use Terraform dynamic blocks to write clean, scalable infrastructure code for security groups and other resources.

1

Create a variable with a list of ports

Create a Terraform variable called allowed_ports with the list [22, 80, 443].

Terraform

# Create a variable called allowed_ports with the list [22, 80, 443]
# Your code here

Hint

Use variable "allowed_ports" and set default to the list of ports.

2

Define an AWS security group resource

Define a resource called aws_security_group named example with name = "example-sg" and description = "Example security group".

Terraform

variable "allowed_ports" {
  type    = list(number)
  default = [22, 80, 443]
}

# Define aws_security_group resource named example
# Your code here

Hint

Use resource "aws_security_group" "example" and set name and description.

3

Add a dynamic block for ingress rules

Inside the aws_security_group.example resource, add a dynamic block named ingress that iterates over var.allowed_ports. For each port, set from_port and to_port to the port number, protocol to "tcp", and cidr_blocks to ["0.0.0.0/0"].

Terraform

variable "allowed_ports" {
  type    = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name        = "example-sg"
  description = "Example security group"

  # Add dynamic ingress block here
  # Your code here
}

Hint

Use dynamic "ingress" with for_each = var.allowed_ports and set the block content accordingly.

4

Add an egress rule to allow all outbound traffic

Inside the aws_security_group.example resource, add an egress block that allows all outbound traffic by setting from_port and to_port to 0, protocol to "-1", and cidr_blocks to ["0.0.0.0/0"].

Terraform

variable "allowed_ports" {
  type    = list(number)
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name        = "example-sg"
  description = "Example security group"

  dynamic "ingress" {
    for_each = var.allowed_ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

  # Add egress block here
  # Your code here
}

Hint

Add an egress block with the specified settings to allow all outbound traffic.

Practice

1. What is the main purpose of using dynamic blocks in Terraform security groups?

easy

A. To delete all security group rules at once

B. To manually write each security group rule one by one

C. To encrypt security group rules for security

D. To create multiple similar security group rules from a list automatically

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating a block of code multiple times based on a list or map input.

2. Step 2: Apply this to security groups

   In security groups, dynamic blocks help create many similar rules without writing each rule manually.

3. Final Answer:

   To create multiple similar security group rules from a list automatically -> Option D

4. Quick Check:

   Dynamic blocks automate repeated blocks [OK]

Hint: Dynamic blocks repeat code for lists automatically [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Believing dynamic blocks encrypt rules
• Confusing dynamic blocks with manual rule writing

2. Which of the following is the correct syntax to start a dynamic block named ingress in a Terraform security group resource?

easy

A. dynamic ingress {

B. dynamic "ingress" {

C. dynamic ingress() {

D. dynamic "ingress"() {

Solution

1. Step 1: Recall Terraform dynamic block syntax

   Dynamic blocks use the keyword dynamic followed by the block name in quotes and curly braces.

2. Step 2: Match syntax for ingress block

   The correct syntax is dynamic "ingress" { to define a dynamic ingress block.

3. Final Answer:

   dynamic "ingress" { -> Option B

4. Quick Check:

   Dynamic block name must be in quotes [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around block name
• Adding parentheses after block name
• Using incorrect keywords

3. Given the following Terraform snippet, what will be the number of ingress rules created?

variable "ports" {
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

medium

A. 3 ingress rules, one for each port

B. 1 ingress rule with ports 22, 80, and 443 combined

C. No ingress rules created due to syntax error

D. Ingress rules created only for port 22

Solution

1. Step 1: Analyze the for_each expression

   The dynamic block uses for_each = var.ports where ports are [22, 80, 443]. This means it loops 3 times.

2. Step 2: Understand content block creation

   Each iteration creates one ingress rule with from_port and to_port set to the current port value.

3. Final Answer:

   3 ingress rules, one for each port -> Option A

4. Quick Check:

   One rule per list item = 3 rules [OK]

Hint: Count list items for number of dynamic blocks created [OK]

Common Mistakes:

• Thinking all ports combine into one rule
• Assuming syntax error without checking
• Ignoring for_each iteration count

4. Identify the error in this Terraform dynamic block for security group ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port   = rule.value.from
    to_port     = rule.value.to
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. for_each must be a map, not a list

B. Missing quotes around "ingress" in dynamic block

C. Incorrect reference to loop variable; should use ingress.value instead of rule.value

D. cidr_blocks cannot be a list

Solution

1. Step 1: Check loop variable usage inside dynamic block

   Inside a dynamic block named "ingress", the loop variable is ingress, not rule.

2. Step 2: Correct variable reference

   References should be ingress.value.from and ingress.value.to to access current item values.

3. Final Answer:

   Incorrect reference to loop variable; should use ingress.value instead of rule.value -> Option C

4. Quick Check:

   Loop variable matches dynamic block name [OK]

Hint: Loop variable = dynamic block name [OK]

Common Mistakes:

• Using wrong loop variable name
• Omitting quotes around dynamic block name
• Misunderstanding for_each data types

5. You want to create a security group with dynamic ingress rules from a list of maps, but only include rules where enabled is true. Which Terraform code snippet correctly uses a dynamic block with filtering?

variable "rules" {
  default = [
    { from = 22, to = 22, enabled = true },
    { from = 80, to = 80, enabled = false },
    { from = 443, to = 443, enabled = true }
  ]
}

resource "aws_security_group" "filtered" {
  name = "filtered-sg"

  dynamic "ingress" {
    for_each = ???
    content {
      from_port   = ingress.value.from
      to_port     = ingress.value.to
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

hard

A. for_each = [for r in var.rules : r if r.enabled]

B. for_each = var.rules

C. for_each = { for r in var.rules : r.from => r if r.enabled }

D. for_each = filter(var.rules, r => r.enabled)

Solution

1. Step 1: Understand filtering with for expressions

   Terraform uses for expressions with an if condition to filter lists, e.g. [for r in var.rules : r if r.enabled].

2. Step 2: Apply filtered list to for_each

   Using this filtered list in for_each creates dynamic blocks only for enabled rules.

3. Final Answer:

   for_each = [for r in var.rules : r if r.enabled] -> Option A

4. Quick Check:

   Use for expression with if to filter list [OK]

Hint: Filter list with for expression and if condition [OK]

Common Mistakes:

• Using unfiltered list causing unwanted rules
• Trying to use non-existent filter() function
• Using map instead of list for for_each