For_each for map-based instances in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding for_each with map variables

Given the following Terraform map variable:

variable "servers" {
  type = map(string)
  default = {
    web = "10.0.1.1"
    db  = "10.0.1.2"
  }
}

Which for_each expression correctly creates one resource per server with the key as the resource name?

A for_each = toset(var.servers)

B for_each = values(var.servers)

C for_each = keys(var.servers)

D for_each = var.servers

💡 Hint

Think about what for_each expects to iterate over to create resources with keys.

The for_each argument expects a map or set of strings. Using var.servers directly (a map) allows Terraform to create one resource per key-value pair, using the map keys as resource instance keys.

❓ Configuration

intermediate

Correct resource block using for_each with map

Which resource block correctly uses for_each to create AWS instances from the map below, assigning the instance name from the map key?

variable "instances" {
  default = {
    app = "ami-123456"
    db  = "ami-654321"
  }
}

A

resource "aws_instance" "example" {
  for_each = keys(var.instances)
  ami      = var.instances[each.key]
  tags = {
    Name = each.key
  }
}

B

resource "aws_instance" "example" {
  for_each = toset(var.instances)
  ami      = each.key
  tags = {
    Name = each.value
  }
}

C

resource "aws_instance" "example" {
  for_each = var.instances
  ami      = each.value
  tags = {
    Name = each.key
  }
}

D

resource "aws_instance" "example" {
  for_each = values(var.instances)
  ami      = each.value
  tags = {
    Name = each.key
  }
}

💡 Hint

Remember that for_each with a map gives each.key and each.value.

Option C correctly uses for_each = var.instances so each.key is the map key (app, db) and each.value is the AMI ID. This allows naming the instance with the key and setting the AMI from the value.

❓ Architecture

advanced

Scaling infrastructure with map-based for_each

You have a map variable defining server roles and counts:

variable "server_roles" {
  default = {
    web = 3
    db  = 2
  }
}

Which approach correctly creates the specified number of instances per role using for_each with maps?

A Use <code>for_each = { for role, count in var.server_roles : for i in range(count) : "${role}-${i}" => role }</code> to flatten keys for each instance

B Use <code>for_each = { for role, count in var.server_roles : role => count }</code> and inside resource use <code>count.index</code> to create multiple instances

C Use <code>for_each = { for role, count in var.server_roles : "${role}-${count}" => count }</code> and create one resource per key

D Use <code>for_each = { for role, count in var.server_roles : role => range(count) }</code> and iterate over ranges

💡 Hint

Think about how to create unique keys for each instance when count > 1.

Option A correctly uses nested for expressions to create a flat map with unique keys like 'web-0', 'web-1', etc., allowing for_each to create multiple instances per role.

❓ security

advanced

Avoiding sensitive data exposure in for_each maps

You have a map variable with server names and passwords:

variable "server_passwords" {
  type = map(string)
  default = {
    app = "pass123"
    db  = "secret456"
  }
}

Which Terraform practice prevents exposing passwords in resource logs when using for_each?

A Use <code>for_each = var.server_passwords</code> but mark the password attribute as <code>sensitive = true</code> in the resource

B Use <code>for_each = var.server_passwords</code> directly and output the passwords as resource attributes

C Convert the map to a list and use <code>count</code> instead of <code>for_each</code>

D Store passwords in plain text in Terraform state and avoid marking sensitive

💡 Hint

Terraform has a way to mark sensitive values to avoid logging them.

Option A is correct because marking attributes as sensitive = true prevents Terraform from showing passwords in logs or UI, even when using for_each with maps containing secrets.

❓ service_behavior

expert

Terraform state behavior with map-based for_each resource changes

Given a resource using for_each over a map:

resource "aws_instance" "example" {
  for_each = {
    alpha = "ami-111"
    beta  = "ami-222"
  }
  ami           = each.value
  instance_type = "t2.micro"
}

If you change the map to:

for_each = {
  beta  = "ami-222"
  gamma = "ami-333"
}

What happens to the Terraform state and resources after applying?

A Terraform updates the 'alpha' instance to use AMI 'ami-333' and keeps 'beta' unchanged

B Terraform destroys the 'alpha' instance and creates a new 'gamma' instance, keeping 'beta' unchanged

C Terraform creates a new instance for 'gamma' but leaves 'alpha' and 'beta' unchanged

D Terraform destroys all instances and recreates them with new keys

💡 Hint

Think about how Terraform tracks resource instances by keys in for_each maps.

Terraform tracks each resource instance by the map key. Removing 'alpha' from the map causes Terraform to destroy that instance. Adding 'gamma' creates a new instance. 'beta' remains unchanged because its key and value remain.