Dynamic blocks vs for_each decision in Terraform - Performance Comparison

Time Complexity: Dynamic blocks vs for_each decision

O(n)

Understanding Time Complexity

We want to understand how the number of operations grows when using dynamic blocks versus for_each in Terraform.

Which approach causes more repeated work as we add more items?

Scenario Under Consideration

Analyze the time complexity of these two Terraform snippets creating multiple sub-blocks.

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
}

resource "aws_security_group" "example_for_each" {
  name = "example-for-each"

  ingress = [for rule in var.ingress_rules : {
    from_port   = rule.from_port
    to_port     = rule.to_port
    protocol    = rule.protocol
    cidr_blocks = rule.cidr_blocks
  }]
}
    

Both create multiple ingress rules, one using dynamic blocks, the other using for_each in a list.

Identify Repeating Operations

Look at what repeats as the number of ingress rules grows.

• Primary operation: Creating one ingress rule block per item in the input list.
• How many times: Once for each ingress rule in var.ingress_rules.

How Execution Grows With Input

As you add more ingress rules, Terraform creates more blocks or list items.

Input Size (n)	Approx. Api Calls/Operations
10	10 ingress blocks created
100	100 ingress blocks created
1000	1000 ingress blocks created

Pattern observation: The number of operations grows directly with the number of ingress rules.

Final Time Complexity

Time Complexity: O(n)

This means the work grows in a straight line as you add more ingress rules.

Common Mistake

[X] Wrong: "Using dynamic blocks is slower because it loops inside Terraform, but for_each is faster."

[OK] Correct: Both approaches create one block per item, so the number of operations grows the same way. The difference is mostly in syntax, not performance.

Interview Connect

Understanding how repeating resource blocks scale helps you design infrastructure code that stays manageable as it grows.

Self-Check

What if we nested dynamic blocks inside each other? How would the time complexity change?

Practice

1. Which Terraform feature should you use to repeat a nested block inside a single resource?

easy

A. Dynamic blocks

B. for_each on the resource

C. count on the resource

D. locals block

Solution

1. Step 1: Understand nested block repetition

   Dynamic blocks are designed to repeat nested blocks inside a single resource.

2. Step 2: Compare with for_each usage

   for_each repeats entire resources or top-level blocks, not nested blocks.

3. Final Answer:

   Dynamic blocks -> Option A

4. Quick Check:

   Nested block repetition = Dynamic blocks [OK]

Hint: Use dynamic blocks for nested repeated settings [OK]

Common Mistakes:

• Using for_each to repeat nested blocks inside one resource
• Confusing count with dynamic blocks
• Trying to use locals for repeating blocks

2. Which syntax correctly uses a dynamic block inside a resource to repeat a nested block named setting?

easy

A. locals { setting = var.settings } resource { setting = local.setting }

B. for_each = var.settings { setting { key = each.value } }

C. count = length(var.settings) setting { key = var.settings[count.index] }

D. dynamic "setting" { for_each = var.settings; content { key = each.value } }

Solution

1. Step 1: Identify correct dynamic block syntax

   Dynamic blocks use the syntax: dynamic "block_name" { for_each = ... content { ... } }.

2. Step 2: Check other options for syntax errors

   Options A, B, and C misuse for_each, count, or locals incorrectly for nested blocks.

3. Final Answer:

   dynamic "setting" { for_each = var.settings; content { key = each.value } } -> Option D

4. Quick Check:

   Correct dynamic block syntax = dynamic "setting" { for_each = var.settings; content { key = each.value } } [OK]

Hint: Dynamic blocks use dynamic "name" with for_each and content [OK]

Common Mistakes:

• Placing for_each directly inside resource without dynamic
• Using count for nested blocks
• Trying to assign locals directly as blocks

3. Given this Terraform snippet, what will be the number of aws_security_group_rule resources created?

resource "aws_security_group_rule" "example" {
  for_each = { for idx, port in var.ports : idx => port }
  type        = "ingress"
  from_port   = each.value
  to_port     = each.value
  protocol    = "tcp"
  security_group_id = var.sg_id
}

Assuming var.ports = [80, 443].

medium

A. 1 resource

B. 2 resources

C. No resources, syntax error

D. One resource with two ports

Solution

1. Step 1: Understand for_each on resource

   for_each creates one resource instance per map or set element. Here, var.ports has 2 elements.

2. Step 2: Count resource instances

   Since var.ports has 2 ports, Terraform creates 2 aws_security_group_rule resources, one for each port.

3. Final Answer:

   2 resources -> Option B

4. Quick Check:

   for_each with 2 items = 2 resources [OK]

Hint: for_each creates one resource per item in collection [OK]

Common Mistakes:

• Thinking for_each creates one resource regardless of items
• Confusing dynamic blocks with resource repetition
• Assuming ports combine into one resource

4. This Terraform code throws an error. What is the main issue?

resource "aws_instance" "example" {
  for_each = var.instances
  ami           = "ami-123456"
  instance_type = "t2.micro"

  dynamic "ebs_block_device" {
    for_each = each.value.ebs_volumes
    content {
      device_name = ebs_block_device.value.device_name
      volume_size = ebs_block_device.value.size
    }
  }
}

Assuming var.instances is a map with nested ebs_volumes lists.

medium

A. Dynamic blocks cannot be nested inside resources

B. for_each cannot be used on resources

C. Incorrect reference to dynamic block variable inside content

D. Missing count argument on resource

Solution

1. Step 1: Identify the error in dynamic block reference

   Inside the content block of a dynamic block, the iterator must be referenced as each.value, not ebs_block_device.value. The iterator variable is always each regardless of the dynamic block name.

2. Step 2: Confirm the fix

   Change to device_name = each.value.device_name and volume_size = each.value.size. Other options are incorrect: dynamic blocks work inside resources, for_each works on resources, count is not required.

3. Final Answer:

   Incorrect reference to dynamic block variable inside content -> Option C

4. Quick Check:

   Dynamic block content uses each.value [OK]

Hint: Inside dynamic content, always use each.value, not block_name.value [OK]

Common Mistakes:

• Using block_name.value inside dynamic block content instead of each.value
• Trying to use for_each on resource incorrectly
• Forgetting to define for_each on dynamic block

5. You want to create multiple AWS IAM users, each with multiple inline policies. Which Terraform approach is best to manage this efficiently? A snippet of your variables:

variable "users" {
  type = map(object({
    policies = list(object({
      name   = string
      policy = string
    }))
  }))
}

hard

A. Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

B. Use count on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

C. Use for_each on aws_iam_user resource for users, and dynamic blocks inside aws_iam_user_policy for policies

D. Use dynamic blocks on aws_iam_user resource for users, and count on aws_iam_user_policy for policies

Solution

1. Step 1: Manage multiple users

   Use for_each on aws_iam_user resource to create one user per map entry.

2. Step 2: Manage multiple policies per user

   Since policies are separate resources (aws_iam_user_policy), use for_each on that resource to create one policy per user-policy pair.

3. Step 3: Why not dynamic blocks here?

   Dynamic blocks repeat nested blocks inside a resource, but aws_iam_user_policy is a separate resource, so for_each is appropriate.

4. Final Answer:

   Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies -> Option A

5. Quick Check:

   Multiple resources = for_each on both [OK]

Hint: Use for_each for multiple resources, dynamic blocks for nested blocks [OK]

Common Mistakes:

• Using dynamic blocks to create multiple resources
• Using count instead of for_each for maps
• Trying to nest policies inside user resource with dynamic blocks