Why Dynamic blocks in security groups in Terraform? - Purpose & Use Cases

The Big Idea

What if you could write one list and have all your security rules created perfectly every time?

The Scenario

Imagine you have to create a security group with many rules, each allowing different ports and IPs. You write each rule by hand, repeating similar code again and again.

The Problem

This manual way is slow and boring. If you want to add or change a rule, you must edit many places. It's easy to make mistakes or forget something. Managing many rules becomes a headache.

The Solution

Dynamic blocks let you write one simple loop that creates all the rules automatically. You just list the rules once, and Terraform builds the security group for you. It saves time and avoids errors.

Before vs After

✗ Before

ingress {
  from_port = 80
  to_port = 80
  protocol = "tcp"
  cidr_blocks = ["10.0.0.0/24"]
}
ingress {
  from_port = 443
  to_port = 443
  protocol = "tcp"
  cidr_blocks = ["10.0.1.0/24"]
}

✓ After

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port = each.value.from_port
    to_port = each.value.to_port
    protocol = each.value.protocol
    cidr_blocks = each.value.cidr_blocks
  }
}

What It Enables

You can quickly create and update many security rules by changing just one list, making your infrastructure flexible and error-free.

Real Life Example

A company needs to open different ports for multiple teams. Instead of writing many blocks, they list the rules once. Terraform then builds the security group with all needed rules automatically.

Key Takeaways

Manual security group rules are repetitive and error-prone.

Dynamic blocks automate rule creation using simple lists.

This makes managing security groups faster and safer.

Practice

1. What is the main purpose of using dynamic blocks in Terraform security groups?

easy

A. To delete all security group rules at once

B. To manually write each security group rule one by one

C. To encrypt security group rules for security

D. To create multiple similar security group rules from a list automatically

Solution

1. Step 1: Understand the role of dynamic blocks

   Dynamic blocks allow repeating a block of code multiple times based on a list or map input.

2. Step 2: Apply this to security groups

   In security groups, dynamic blocks help create many similar rules without writing each rule manually.

3. Final Answer:

   To create multiple similar security group rules from a list automatically -> Option D

4. Quick Check:

   Dynamic blocks automate repeated blocks [OK]

Hint: Dynamic blocks repeat code for lists automatically [OK]

Common Mistakes:

• Thinking dynamic blocks delete rules
• Believing dynamic blocks encrypt rules
• Confusing dynamic blocks with manual rule writing

2. Which of the following is the correct syntax to start a dynamic block named ingress in a Terraform security group resource?

easy

A. dynamic ingress {

B. dynamic "ingress" {

C. dynamic ingress() {

D. dynamic "ingress"() {

Solution

1. Step 1: Recall Terraform dynamic block syntax

   Dynamic blocks use the keyword dynamic followed by the block name in quotes and curly braces.

2. Step 2: Match syntax for ingress block

   The correct syntax is dynamic "ingress" { to define a dynamic ingress block.

3. Final Answer:

   dynamic "ingress" { -> Option B

4. Quick Check:

   Dynamic block name must be in quotes [OK]

Hint: Use quotes around block name in dynamic block [OK]

Common Mistakes:

• Omitting quotes around block name
• Adding parentheses after block name
• Using incorrect keywords

3. Given the following Terraform snippet, what will be the number of ingress rules created?

variable "ports" {
  default = [22, 80, 443]
}

resource "aws_security_group" "example" {
  name = "example-sg"

  dynamic "ingress" {
    for_each = var.ports
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

medium

A. 3 ingress rules, one for each port

B. 1 ingress rule with ports 22, 80, and 443 combined

C. No ingress rules created due to syntax error

D. Ingress rules created only for port 22

Solution

1. Step 1: Analyze the for_each expression

   The dynamic block uses for_each = var.ports where ports are [22, 80, 443]. This means it loops 3 times.

2. Step 2: Understand content block creation

   Each iteration creates one ingress rule with from_port and to_port set to the current port value.

3. Final Answer:

   3 ingress rules, one for each port -> Option A

4. Quick Check:

   One rule per list item = 3 rules [OK]

Hint: Count list items for number of dynamic blocks created [OK]

Common Mistakes:

• Thinking all ports combine into one rule
• Assuming syntax error without checking
• Ignoring for_each iteration count

4. Identify the error in this Terraform dynamic block for security group ingress rules:

dynamic "ingress" {
  for_each = var.rules
  content {
    from_port   = rule.value.from
    to_port     = rule.value.to
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

medium

A. for_each must be a map, not a list

B. Missing quotes around "ingress" in dynamic block

C. Incorrect reference to loop variable; should use ingress.value instead of rule.value

D. cidr_blocks cannot be a list

Solution

1. Step 1: Check loop variable usage inside dynamic block

   Inside a dynamic block named "ingress", the loop variable is ingress, not rule.

2. Step 2: Correct variable reference

   References should be ingress.value.from and ingress.value.to to access current item values.

3. Final Answer:

   Incorrect reference to loop variable; should use ingress.value instead of rule.value -> Option C

4. Quick Check:

   Loop variable matches dynamic block name [OK]

Hint: Loop variable = dynamic block name [OK]

Common Mistakes:

• Using wrong loop variable name
• Omitting quotes around dynamic block name
• Misunderstanding for_each data types

5. You want to create a security group with dynamic ingress rules from a list of maps, but only include rules where enabled is true. Which Terraform code snippet correctly uses a dynamic block with filtering?

variable "rules" {
  default = [
    { from = 22, to = 22, enabled = true },
    { from = 80, to = 80, enabled = false },
    { from = 443, to = 443, enabled = true }
  ]
}

resource "aws_security_group" "filtered" {
  name = "filtered-sg"

  dynamic "ingress" {
    for_each = ???
    content {
      from_port   = ingress.value.from
      to_port     = ingress.value.to
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

hard

A. for_each = [for r in var.rules : r if r.enabled]

B. for_each = var.rules

C. for_each = { for r in var.rules : r.from => r if r.enabled }

D. for_each = filter(var.rules, r => r.enabled)

Solution

1. Step 1: Understand filtering with for expressions

   Terraform uses for expressions with an if condition to filter lists, e.g. [for r in var.rules : r if r.enabled].

2. Step 2: Apply filtered list to for_each

   Using this filtered list in for_each creates dynamic blocks only for enabled rules.

3. Final Answer:

   for_each = [for r in var.rules : r if r.enabled] -> Option A

4. Quick Check:

   Use for expression with if to filter list [OK]

Hint: Filter list with for expression and if condition [OK]

Common Mistakes:

• Using unfiltered list causing unwanted rules
• Trying to use non-existent filter() function
• Using map instead of list for for_each