Dynamic blocks vs for_each decision in Terraform - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

When to use dynamic blocks instead of for_each in Terraform?

Which situation best justifies using a dynamic block over for_each in Terraform configuration?

A When you want to conditionally create a resource based on a boolean variable.

B When you want to create multiple independent resources from a map of values.

C When you need to generate multiple nested blocks inside a resource based on a list or map.

D When you want to loop over a list to create multiple top-level modules.

💡 Hint

Think about the difference between repeating nested blocks inside a resource versus creating multiple resources.

Dynamic blocks are used to generate repeated nested blocks inside a single resource or module block. for_each is used to create multiple instances of a resource or module.

❓ Architecture

intermediate

Choosing between dynamic blocks and for_each for nested security rules

You have a Terraform resource for a firewall that supports multiple security_rule nested blocks. You have a list of security rules to apply. Which approach correctly applies all rules inside a single firewall resource?

Terraform

resource "firewall" "example" {
  name = "example-firewall"

  # Fill in here
}

A Use for_each on the firewall resource to create multiple firewall resources, each with one security_rule.

B Use a dynamic block to iterate over the list and create multiple <code>security_rule</code> blocks inside the firewall resource.

C Use count on the firewall resource to create multiple firewalls, each with all security rules.

D Use a separate resource for each security_rule outside the firewall resource.

💡 Hint

Remember that nested blocks inside a resource can be repeated with dynamic blocks.

Dynamic blocks allow you to generate multiple nested blocks inside a single resource. Using for_each on the resource creates multiple resources, which is not desired here.

❓ Configuration

advanced

Terraform code output with dynamic block vs for_each

Given the following Terraform snippet, what will be the value of resource.firewall.example.security_rule after apply?

Terraform

variable "rules" {
  default = [
    { name = "allow-ssh", port = 22 },
    { name = "allow-http", port = 80 }
  ]
}

resource "firewall" "example" {
  name = "example-firewall"

  dynamic "security_rule" {
    for_each = var.rules
    content {
      name = each.value.name
      port = each.value.port
    }
  }
}

A null

B {"allow-ssh":22,"allow-http":80}

C ["allow-ssh","allow-http"]

D [{"name":"allow-ssh","port":22},{"name":"allow-http","port":80}]

💡 Hint

Think about how dynamic blocks create nested blocks with full attributes.

The dynamic block creates two nested security_rule blocks with full attributes as objects in a list.

❓ security

advanced

Security risk of using for_each on resource vs dynamic block for nested blocks

What is a potential security risk when using for_each to create multiple resources instead of using a dynamic block to create nested blocks inside a single resource?

A Multiple resources may cause inconsistent security policies if one resource is updated but others are not.

B Dynamic blocks always encrypt data, so for_each is less secure.

C Using for_each causes resources to be publicly accessible by default.

D for_each disables Terraform state locking, risking concurrent changes.

💡 Hint

Consider how multiple resources might be managed differently than one resource with nested blocks.

Creating multiple resources with for_each can lead to inconsistent updates or drift if some resources are changed and others are not, risking security policy gaps.

❓ service_behavior

expert

Terraform behavior when mixing dynamic blocks and for_each on nested blocks

Consider a Terraform resource that uses both for_each on the resource itself and a dynamic block inside it to create nested blocks. What is the expected behavior after apply?

Terraform

variable "instances" {
  default = ["one", "two"]
}

variable "rules" {
  default = [
    { name = "rule1", port = 8080 },
    { name = "rule2", port = 9090 }
  ]
}

resource "firewall" "example" {
  for_each = toset(var.instances)
  name = "firewall-${each.key}"

  dynamic "security_rule" {
    for_each = var.rules
    content {
      name = each.value.name
      port = each.value.port
    }
  }
}

A Creates two firewall resources, each with two nested security_rule blocks as defined in var.rules.

B Creates two firewall resources but only one nested security_rule block each.

C Fails to apply due to conflicting for_each usage inside resource and dynamic block.

D Creates one firewall resource with four nested security_rule blocks combining all rules.

💡 Hint

Think about how for_each on resource and dynamic blocks inside it combine.

The for_each on the resource creates two firewall resources. Each resource uses the dynamic block to create two nested security_rule blocks, so total four nested blocks across two resources.

Practice

1. Which Terraform feature should you use to repeat a nested block inside a single resource?

easy

A. Dynamic blocks

B. for_each on the resource

C. count on the resource

D. locals block

Solution

1. Step 1: Understand nested block repetition

   Dynamic blocks are designed to repeat nested blocks inside a single resource.

2. Step 2: Compare with for_each usage

   for_each repeats entire resources or top-level blocks, not nested blocks.

3. Final Answer:

   Dynamic blocks -> Option A

4. Quick Check:

   Nested block repetition = Dynamic blocks [OK]

Hint: Use dynamic blocks for nested repeated settings [OK]

Common Mistakes:

• Using for_each to repeat nested blocks inside one resource
• Confusing count with dynamic blocks
• Trying to use locals for repeating blocks

2. Which syntax correctly uses a dynamic block inside a resource to repeat a nested block named setting?

easy

A. locals { setting = var.settings } resource { setting = local.setting }

B. for_each = var.settings { setting { key = each.value } }

C. count = length(var.settings) setting { key = var.settings[count.index] }

D. dynamic "setting" { for_each = var.settings; content { key = each.value } }

Solution

1. Step 1: Identify correct dynamic block syntax

   Dynamic blocks use the syntax: dynamic "block_name" { for_each = ... content { ... } }.

2. Step 2: Check other options for syntax errors

   Options A, B, and C misuse for_each, count, or locals incorrectly for nested blocks.

3. Final Answer:

   dynamic "setting" { for_each = var.settings; content { key = each.value } } -> Option D

4. Quick Check:

   Correct dynamic block syntax = dynamic "setting" { for_each = var.settings; content { key = each.value } } [OK]

Hint: Dynamic blocks use dynamic "name" with for_each and content [OK]

Common Mistakes:

• Placing for_each directly inside resource without dynamic
• Using count for nested blocks
• Trying to assign locals directly as blocks

3. Given this Terraform snippet, what will be the number of aws_security_group_rule resources created?

resource "aws_security_group_rule" "example" {
  for_each = { for idx, port in var.ports : idx => port }
  type        = "ingress"
  from_port   = each.value
  to_port     = each.value
  protocol    = "tcp"
  security_group_id = var.sg_id
}

Assuming var.ports = [80, 443].

medium

A. 1 resource

B. 2 resources

C. No resources, syntax error

D. One resource with two ports

Solution

1. Step 1: Understand for_each on resource

   for_each creates one resource instance per map or set element. Here, var.ports has 2 elements.

2. Step 2: Count resource instances

   Since var.ports has 2 ports, Terraform creates 2 aws_security_group_rule resources, one for each port.

3. Final Answer:

   2 resources -> Option B

4. Quick Check:

   for_each with 2 items = 2 resources [OK]

Hint: for_each creates one resource per item in collection [OK]

Common Mistakes:

• Thinking for_each creates one resource regardless of items
• Confusing dynamic blocks with resource repetition
• Assuming ports combine into one resource

4. This Terraform code throws an error. What is the main issue?

resource "aws_instance" "example" {
  for_each = var.instances
  ami           = "ami-123456"
  instance_type = "t2.micro"

  dynamic "ebs_block_device" {
    for_each = each.value.ebs_volumes
    content {
      device_name = ebs_block_device.value.device_name
      volume_size = ebs_block_device.value.size
    }
  }
}

Assuming var.instances is a map with nested ebs_volumes lists.

medium

A. Dynamic blocks cannot be nested inside resources

B. for_each cannot be used on resources

C. Incorrect reference to dynamic block variable inside content

D. Missing count argument on resource

Solution

1. Step 1: Identify the error in dynamic block reference

   Inside the content block of a dynamic block, the iterator must be referenced as each.value, not ebs_block_device.value. The iterator variable is always each regardless of the dynamic block name.

2. Step 2: Confirm the fix

   Change to device_name = each.value.device_name and volume_size = each.value.size. Other options are incorrect: dynamic blocks work inside resources, for_each works on resources, count is not required.

3. Final Answer:

   Incorrect reference to dynamic block variable inside content -> Option C

4. Quick Check:

   Dynamic block content uses each.value [OK]

Hint: Inside dynamic content, always use each.value, not block_name.value [OK]

Common Mistakes:

• Using block_name.value inside dynamic block content instead of each.value
• Trying to use for_each on resource incorrectly
• Forgetting to define for_each on dynamic block

5. You want to create multiple AWS IAM users, each with multiple inline policies. Which Terraform approach is best to manage this efficiently? A snippet of your variables:

variable "users" {
  type = map(object({
    policies = list(object({
      name   = string
      policy = string
    }))
  }))
}

hard

A. Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

B. Use count on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

C. Use for_each on aws_iam_user resource for users, and dynamic blocks inside aws_iam_user_policy for policies

D. Use dynamic blocks on aws_iam_user resource for users, and count on aws_iam_user_policy for policies

Solution

1. Step 1: Manage multiple users

   Use for_each on aws_iam_user resource to create one user per map entry.

2. Step 2: Manage multiple policies per user

   Since policies are separate resources (aws_iam_user_policy), use for_each on that resource to create one policy per user-policy pair.

3. Step 3: Why not dynamic blocks here?

   Dynamic blocks repeat nested blocks inside a resource, but aws_iam_user_policy is a separate resource, so for_each is appropriate.

4. Final Answer:

   Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies -> Option A

5. Quick Check:

   Multiple resources = for_each on both [OK]

Hint: Use for_each for multiple resources, dynamic blocks for nested blocks [OK]

Common Mistakes:

• Using dynamic blocks to create multiple resources
• Using count instead of for_each for maps
• Trying to nest policies inside user resource with dynamic blocks