Dynamic blocks vs for_each decision in Terraform - Visual Side-by-Side Comparison

Process Flow - Dynamic blocks vs for_each decision

Start

↓

Identify repeated config

↓

Is block structure repeated?

No→Use for_each on resource

Yes↓

Use dynamic block inside resource

↓

Generate repeated nested blocks

↓

Apply configuration

Decide if repeated nested blocks need dynamic blocks or if repeated resources use for_each, then apply configuration accordingly.

Execution Sample

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port = ingress.value.from
    }
  }
}

This code uses a dynamic block to create multiple ingress rules inside one security group resource.

Process Table

Step	Action	Input	Result	Notes
1	Start processing resource	aws_security_group example	Resource block begins	Prepare to configure security group
2	Evaluate for_each in dynamic block	var.ingress_rules = [{from=80}, {from=443}]	Two ingress blocks to generate	Dynamic block will loop twice
3	Generate first ingress block	ingress.value.from = 80	Ingress block with from_port=80 created	First nested block created
4	Generate second ingress block	ingress.value.from = 443	Ingress block with from_port=443 created	Second nested block created
5	Finish resource configuration	All blocks generated	Resource ready for deployment	Dynamic blocks replaced repeated nested blocks
6	Apply terraform plan	Resource with 2 ingress blocks	Security group created with 2 ingress rules	Deployment successful

💡 All dynamic blocks generated and resource configured, ready for deployment

Status Tracker

Variable	Start	After 1	After 2	Final
var.ingress_rules	[{from=80}, {from=443}]	[{from=80}, {from=443}]	[{from=80}, {from=443}]	[{from=80}, {from=443}]
ingress.value.from	N/A	80	443	N/A after loop

Key Moments - 2 Insights

Why use dynamic blocks instead of for_each on the resource?

Dynamic blocks are used when you need to repeat nested blocks inside a single resource, as shown in steps 2-4 of the execution_table. For_each on the resource creates multiple separate resources instead.

Can for_each replace dynamic blocks for nested repeated blocks?

No, for_each on the resource creates multiple resources, not multiple nested blocks inside one resource. Dynamic blocks handle repeated nested blocks inside a single resource (see step 3 and 4).

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of ingress.value.from at Step 4?

A 80

B 443

C N/A

D 0

💡 Hint

Check the 'Input' column at Step 4 in execution_table

At which step does Terraform finish generating all dynamic blocks?

A Step 3

B Step 4

C Step 5

D Step 6

💡 Hint

Look for 'Finish resource configuration' in the 'Action' column

If var.ingress_rules had 3 items instead of 2, how would the execution_table change?

A There would be 3 rows generating ingress blocks instead of 2

B The resource would be duplicated 3 times

C The dynamic block would not run

D No change in execution_table

💡 Hint

Refer to how dynamic blocks loop over var.ingress_rules in steps 2-4

Concept Snapshot

Dynamic blocks repeat nested blocks inside one resource.
Use for_each to create multiple resources.
Dynamic blocks loop over a list to generate blocks.
For_each on resource duplicates whole resource.
Choose dynamic blocks for nested repeated config.
Choose for_each for multiple similar resources.

Full Transcript

This visual execution shows how Terraform decides between dynamic blocks and for_each. It starts by identifying repeated configuration. If nested blocks repeat inside one resource, dynamic blocks are used. If whole resources repeat, for_each is used on the resource. The example traces a security group resource with a dynamic ingress block looping over two rules. Each iteration creates one ingress nested block with a from_port value. After generating all blocks, the resource is ready for deployment. Variables track the list of ingress rules and current loop value. Key moments clarify that dynamic blocks create repeated nested blocks inside one resource, while for_each duplicates entire resources. The quiz tests understanding of loop values, step completion, and how changing input affects execution. The snapshot summarizes when to use dynamic blocks versus for_each in Terraform.

Practice

1. Which Terraform feature should you use to repeat a nested block inside a single resource?

easy

A. Dynamic blocks

B. for_each on the resource

C. count on the resource

D. locals block

Solution

1. Step 1: Understand nested block repetition

   Dynamic blocks are designed to repeat nested blocks inside a single resource.

2. Step 2: Compare with for_each usage

   for_each repeats entire resources or top-level blocks, not nested blocks.

3. Final Answer:

   Dynamic blocks -> Option A

4. Quick Check:

   Nested block repetition = Dynamic blocks [OK]

Hint: Use dynamic blocks for nested repeated settings [OK]

Common Mistakes:

• Using for_each to repeat nested blocks inside one resource
• Confusing count with dynamic blocks
• Trying to use locals for repeating blocks

2. Which syntax correctly uses a dynamic block inside a resource to repeat a nested block named setting?

easy

A. locals { setting = var.settings } resource { setting = local.setting }

B. for_each = var.settings { setting { key = each.value } }

C. count = length(var.settings) setting { key = var.settings[count.index] }

D. dynamic "setting" { for_each = var.settings; content { key = each.value } }

Solution

1. Step 1: Identify correct dynamic block syntax

   Dynamic blocks use the syntax: dynamic "block_name" { for_each = ... content { ... } }.

2. Step 2: Check other options for syntax errors

   Options A, B, and C misuse for_each, count, or locals incorrectly for nested blocks.

3. Final Answer:

   dynamic "setting" { for_each = var.settings; content { key = each.value } } -> Option D

4. Quick Check:

   Correct dynamic block syntax = dynamic "setting" { for_each = var.settings; content { key = each.value } } [OK]

Hint: Dynamic blocks use dynamic "name" with for_each and content [OK]

Common Mistakes:

• Placing for_each directly inside resource without dynamic
• Using count for nested blocks
• Trying to assign locals directly as blocks

3. Given this Terraform snippet, what will be the number of aws_security_group_rule resources created?

resource "aws_security_group_rule" "example" {
  for_each = { for idx, port in var.ports : idx => port }
  type        = "ingress"
  from_port   = each.value
  to_port     = each.value
  protocol    = "tcp"
  security_group_id = var.sg_id
}

Assuming var.ports = [80, 443].

medium

A. 1 resource

B. 2 resources

C. No resources, syntax error

D. One resource with two ports

Solution

1. Step 1: Understand for_each on resource

   for_each creates one resource instance per map or set element. Here, var.ports has 2 elements.

2. Step 2: Count resource instances

   Since var.ports has 2 ports, Terraform creates 2 aws_security_group_rule resources, one for each port.

3. Final Answer:

   2 resources -> Option B

4. Quick Check:

   for_each with 2 items = 2 resources [OK]

Hint: for_each creates one resource per item in collection [OK]

Common Mistakes:

• Thinking for_each creates one resource regardless of items
• Confusing dynamic blocks with resource repetition
• Assuming ports combine into one resource

4. This Terraform code throws an error. What is the main issue?

resource "aws_instance" "example" {
  for_each = var.instances
  ami           = "ami-123456"
  instance_type = "t2.micro"

  dynamic "ebs_block_device" {
    for_each = each.value.ebs_volumes
    content {
      device_name = ebs_block_device.value.device_name
      volume_size = ebs_block_device.value.size
    }
  }
}

Assuming var.instances is a map with nested ebs_volumes lists.

medium

A. Dynamic blocks cannot be nested inside resources

B. for_each cannot be used on resources

C. Incorrect reference to dynamic block variable inside content

D. Missing count argument on resource

Solution

1. Step 1: Identify the error in dynamic block reference

   Inside the content block of a dynamic block, the iterator must be referenced as each.value, not ebs_block_device.value. The iterator variable is always each regardless of the dynamic block name.

2. Step 2: Confirm the fix

   Change to device_name = each.value.device_name and volume_size = each.value.size. Other options are incorrect: dynamic blocks work inside resources, for_each works on resources, count is not required.

3. Final Answer:

   Incorrect reference to dynamic block variable inside content -> Option C

4. Quick Check:

   Dynamic block content uses each.value [OK]

Hint: Inside dynamic content, always use each.value, not block_name.value [OK]

Common Mistakes:

• Using block_name.value inside dynamic block content instead of each.value
• Trying to use for_each on resource incorrectly
• Forgetting to define for_each on dynamic block

5. You want to create multiple AWS IAM users, each with multiple inline policies. Which Terraform approach is best to manage this efficiently? A snippet of your variables:

variable "users" {
  type = map(object({
    policies = list(object({
      name   = string
      policy = string
    }))
  }))
}

hard

A. Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

B. Use count on aws_iam_user for users, and for_each on aws_iam_user_policy for policies

C. Use for_each on aws_iam_user resource for users, and dynamic blocks inside aws_iam_user_policy for policies

D. Use dynamic blocks on aws_iam_user resource for users, and count on aws_iam_user_policy for policies

Solution

1. Step 1: Manage multiple users

   Use for_each on aws_iam_user resource to create one user per map entry.

2. Step 2: Manage multiple policies per user

   Since policies are separate resources (aws_iam_user_policy), use for_each on that resource to create one policy per user-policy pair.

3. Step 3: Why not dynamic blocks here?

   Dynamic blocks repeat nested blocks inside a resource, but aws_iam_user_policy is a separate resource, so for_each is appropriate.

4. Final Answer:

   Use for_each on aws_iam_user for users, and for_each on aws_iam_user_policy for policies -> Option A

5. Quick Check:

   Multiple resources = for_each on both [OK]

Hint: Use for_each for multiple resources, dynamic blocks for nested blocks [OK]

Common Mistakes:

• Using dynamic blocks to create multiple resources
• Using count instead of for_each for maps
• Trying to nest policies inside user resource with dynamic blocks