Dynamic blocks vs for_each decision in Terraform - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

When to use dynamic blocks instead of for_each in Terraform?

Which situation best justifies using a dynamic block over for_each in Terraform configuration?

A When you want to conditionally create a resource based on a boolean variable.

B When you want to create multiple independent resources from a map of values.

C When you need to generate multiple nested blocks inside a resource based on a list or map.

D When you want to loop over a list to create multiple top-level modules.

💡 Hint

Think about the difference between repeating nested blocks inside a resource versus creating multiple resources.

Dynamic blocks are used to generate repeated nested blocks inside a single resource or module block. for_each is used to create multiple instances of a resource or module.

❓ Architecture

intermediate

Choosing between dynamic blocks and for_each for nested security rules

You have a Terraform resource for a firewall that supports multiple security_rule nested blocks. You have a list of security rules to apply. Which approach correctly applies all rules inside a single firewall resource?

Terraform

resource "firewall" "example" {
  name = "example-firewall"

  # Fill in here
}

A Use for_each on the firewall resource to create multiple firewall resources, each with one security_rule.

B Use a dynamic block to iterate over the list and create multiple <code>security_rule</code> blocks inside the firewall resource.

C Use count on the firewall resource to create multiple firewalls, each with all security rules.

D Use a separate resource for each security_rule outside the firewall resource.

💡 Hint

Remember that nested blocks inside a resource can be repeated with dynamic blocks.

Dynamic blocks allow you to generate multiple nested blocks inside a single resource. Using for_each on the resource creates multiple resources, which is not desired here.

❓ Configuration

advanced

Terraform code output with dynamic block vs for_each

Given the following Terraform snippet, what will be the value of resource.firewall.example.security_rule after apply?

Terraform

variable "rules" {
  default = [
    { name = "allow-ssh", port = 22 },
    { name = "allow-http", port = 80 }
  ]
}

resource "firewall" "example" {
  name = "example-firewall"

  dynamic "security_rule" {
    for_each = var.rules
    content {
      name = each.value.name
      port = each.value.port
    }
  }
}

A null

B {"allow-ssh":22,"allow-http":80}

C ["allow-ssh","allow-http"]

D [{"name":"allow-ssh","port":22},{"name":"allow-http","port":80}]

💡 Hint

Think about how dynamic blocks create nested blocks with full attributes.

The dynamic block creates two nested security_rule blocks with full attributes as objects in a list.

❓ security

advanced

Security risk of using for_each on resource vs dynamic block for nested blocks

What is a potential security risk when using for_each to create multiple resources instead of using a dynamic block to create nested blocks inside a single resource?

A Multiple resources may cause inconsistent security policies if one resource is updated but others are not.

B Dynamic blocks always encrypt data, so for_each is less secure.

C Using for_each causes resources to be publicly accessible by default.

D for_each disables Terraform state locking, risking concurrent changes.

💡 Hint

Consider how multiple resources might be managed differently than one resource with nested blocks.

Creating multiple resources with for_each can lead to inconsistent updates or drift if some resources are changed and others are not, risking security policy gaps.

❓ service_behavior

expert

Terraform behavior when mixing dynamic blocks and for_each on nested blocks

Consider a Terraform resource that uses both for_each on the resource itself and a dynamic block inside it to create nested blocks. What is the expected behavior after apply?

Terraform

variable "instances" {
  default = ["one", "two"]
}

variable "rules" {
  default = [
    { name = "rule1", port = 8080 },
    { name = "rule2", port = 9090 }
  ]
}

resource "firewall" "example" {
  for_each = toset(var.instances)
  name = "firewall-${each.key}"

  dynamic "security_rule" {
    for_each = var.rules
    content {
      name = each.value.name
      port = each.value.port
    }
  }
}

A Creates two firewall resources, each with two nested security_rule blocks as defined in var.rules.

B Creates two firewall resources but only one nested security_rule block each.

C Fails to apply due to conflicting for_each usage inside resource and dynamic block.

D Creates one firewall resource with four nested security_rule blocks combining all rules.

💡 Hint

Think about how for_each on resource and dynamic blocks inside it combine.

The for_each on the resource creates two firewall resources. Each resource uses the dynamic block to create two nested security_rule blocks, so total four nested blocks across two resources.