Dynamic blocks in security groups in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a dynamic block in Terraform?

A dynamic block lets you generate multiple nested blocks inside a resource or module based on a list or map. It helps create repeated configurations without writing them manually.

beginner

Why use dynamic blocks in security groups?

Dynamic blocks allow you to create multiple security group rules easily from a list of rules, making your code cleaner and easier to manage.

intermediate

In Terraform, what does the 'for_each' argument inside a dynamic block do?

'for_each' loops over a collection (list or map) and creates one nested block for each item in that collection.

intermediate

How do you reference the current item inside a dynamic block?

You use the 'each.value' expression to access the current item in the loop inside the dynamic block.

intermediate

Give a simple example of a dynamic block inside an AWS security group resource.

Inside the aws_security_group resource, you can use a dynamic block to create multiple ingress rules from a list, like this: dynamic "ingress" { for_each = var.ingress_rules content { from_port = each.value.from_port to_port = each.value.to_port protocol = each.value.protocol cidr_blocks = each.value.cidr_blocks } }

What is the main benefit of using dynamic blocks in Terraform security groups?

A To speed up Terraform apply by skipping validations

B To create multiple repeated blocks from a list or map automatically

C To encrypt security group rules

D To create security groups without specifying rules

Dynamic blocks let you generate repeated nested blocks based on a collection, reducing manual repetition.

Which keyword is used inside a dynamic block to loop over items?

A for_each

B loop

C repeat

D iterate

'for_each' is the correct keyword to loop over a list or map inside a dynamic block.

How do you access the current item in a dynamic block loop?

A each.value

B item.value

C current.value

D this.value

'each.value' refers to the current element in the for_each loop inside the dynamic block.

What type of Terraform resource commonly uses dynamic blocks for multiple rules?

A aws_s3_bucket

B aws_instance

C aws_lambda_function

D aws_security_group

aws_security_group often uses dynamic blocks to define multiple ingress or egress rules.

If you have a list of ingress rules, how does a dynamic block help?

A It disables ingress rules

B It merges all rules into one block

C It creates one ingress block per rule automatically

D It deletes all rules before applying

Dynamic blocks create one nested block for each item in the list, automating rule creation.

Explain how dynamic blocks work in Terraform security groups and why they are useful.

Think about how to avoid repeating similar blocks manually.

Describe a simple Terraform example using a dynamic block to create multiple ingress rules in an AWS security group.

Imagine you have a list of rules and want Terraform to create one ingress block per rule.

Practice

1. What is the main purpose of using dynamic blocks in Terraform security groups?

easy

A. To delete all security group rules at once

B. To manually write each security group rule one by one

C. To encrypt security group rules for security

D. To create multiple similar security group rules from a list automatically

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating a block of code multiple times based on a list or map input.

2. Step 2: Apply this to security groups

   In security groups, dynamic blocks help create many similar rules without writing each rule manually.

3. Final Answer:

   To create multiple similar security group rules from a list automatically -> Option D

4. Quick Check:

   Dynamic blocks automate repeated blocks [OK]

Hint: Dynamic blocks repeat code for lists automatically [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Believing dynamic blocks encrypt rules
• Confusing dynamic blocks with manual rule writing

2. Which of the following is the correct syntax to start a dynamic block named ingress in a Terraform security group resource?

easy

A. dynamic ingress {

B. dynamic "ingress" {

C. dynamic ingress() {

D. dynamic "ingress"() {

Solution

1. Step 1: Recall Terraform dynamic block syntax

   Dynamic blocks use the keyword dynamic followed by the block name in quotes and curly braces.

2. Step 2: Match syntax for ingress block

   The correct syntax is dynamic "ingress" { to define a dynamic ingress block.

3. Final Answer:

   dynamic "ingress" { -> Option B

4. Quick Check:

   Dynamic block name must be in quotes [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around block name
• Adding parentheses after block name
• Using incorrect keywords

3. Given the following Terraform snippet, what will be the number of ingress rules created?

variable "ports" {
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

medium

A. 3 ingress rules, one for each port

B. 1 ingress rule with ports 22, 80, and 443 combined

C. No ingress rules created due to syntax error

D. Ingress rules created only for port 22

Solution

1. Step 1: Analyze the for_each expression

   The dynamic block uses for_each = var.ports where ports are [22, 80, 443]. This means it loops 3 times.

2. Step 2: Understand content block creation

   Each iteration creates one ingress rule with from_port and to_port set to the current port value.

3. Final Answer:

   3 ingress rules, one for each port -> Option A

4. Quick Check:

   One rule per list item = 3 rules [OK]

Hint: Count list items for number of dynamic blocks created [OK]

Common Mistakes:

• Thinking all ports combine into one rule
• Assuming syntax error without checking
• Ignoring for_each iteration count

4. Identify the error in this Terraform dynamic block for security group ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port   = rule.value.from
    to_port     = rule.value.to
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. for_each must be a map, not a list

B. Missing quotes around "ingress" in dynamic block

C. Incorrect reference to loop variable; should use ingress.value instead of rule.value

D. cidr_blocks cannot be a list

Solution

1. Step 1: Check loop variable usage inside dynamic block

   Inside a dynamic block named "ingress", the loop variable is ingress, not rule.

2. Step 2: Correct variable reference

   References should be ingress.value.from and ingress.value.to to access current item values.

3. Final Answer:

   Incorrect reference to loop variable; should use ingress.value instead of rule.value -> Option C

4. Quick Check:

   Loop variable matches dynamic block name [OK]

Hint: Loop variable = dynamic block name [OK]

Common Mistakes:

• Using wrong loop variable name
• Omitting quotes around dynamic block name
• Misunderstanding for_each data types

5. You want to create a security group with dynamic ingress rules from a list of maps, but only include rules where enabled is true. Which Terraform code snippet correctly uses a dynamic block with filtering?

variable "rules" {
  default = [
    { from = 22, to = 22, enabled = true },
    { from = 80, to = 80, enabled = false },
    { from = 443, to = 443, enabled = true }
  ]
}

resource "aws_security_group" "filtered" {
  name = "filtered-sg"

  dynamic "ingress" {
    for_each = ???
    content {
      from_port   = ingress.value.from
      to_port     = ingress.value.to
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

hard

A. for_each = [for r in var.rules : r if r.enabled]

B. for_each = var.rules

C. for_each = { for r in var.rules : r.from => r if r.enabled }

D. for_each = filter(var.rules, r => r.enabled)

Solution

1. Step 1: Understand filtering with for expressions

   Terraform uses for expressions with an if condition to filter lists, e.g. [for r in var.rules : r if r.enabled].

2. Step 2: Apply filtered list to for_each

   Using this filtered list in for_each creates dynamic blocks only for enabled rules.

3. Final Answer:

   for_each = [for r in var.rules : r if r.enabled] -> Option A

4. Quick Check:

   Use for expression with if to filter list [OK]

Hint: Filter list with for expression and if condition [OK]

Common Mistakes:

• Using unfiltered list causing unwanted rules
• Trying to use non-existent filter() function
• Using map instead of list for for_each