Nested dynamic blocks in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Output of nested dynamic blocks in Terraform

Given the following Terraform configuration snippet using nested dynamic blocks, what will be the value of the resource's tags attribute after deployment?

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  dynamic "tags" {
    for_each = { env = "prod", team = "devops" }
    content {
      key   = tags.key
      value = tags.value

      dynamic "subtag" {
        for_each = { owner = "alice", project = "cloud" }
        content {
          key   = subtag.key
          value = subtag.value
        }
      }
    }
  }
}

A {"env": "prod", "team": "devops", "owner": "alice", "project": "cloud"}

B SyntaxError: Invalid nested dynamic block usage

C {"env": "prod", "team": "devops"}

D {"tags": [{"key": "env", "value": "prod", "subtag": [{"key": "owner", "value": "alice"}, {"key": "project", "value": "cloud"}]}, {"key": "team", "value": "devops", "subtag": [{"key": "owner", "value": "alice"}, {"key": "project", "value": "cloud"}]}]}

💡 Hint

Remember that nested dynamic blocks create nested lists or maps in the resource attributes.

The outer dynamic block iterates over two tags, each producing a map with key and value. The inner dynamic block adds a list of subtag maps inside each tag. This results in a list of tag objects, each containing a list of subtag objects.

❓ service_behavior

intermediate

Behavior of nested dynamic blocks with empty inner for_each

In Terraform, if the inner nested dynamic block's for_each is an empty map, what will be the effect on the resource attribute generated by the nested dynamic blocks?

Terraform

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = { http = 80, https = 443 }
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"

      dynamic "cidr_blocks" {
        for_each = {}
        content {
          cidr_block = cidr_blocks.value
        }
      }
    }
  }
}

A The ingress blocks will have empty cidr_blocks attributes (empty lists).

B Terraform will raise a runtime error due to empty inner for_each.

C The ingress blocks will not include the cidr_blocks attribute at all.

D Terraform will ignore the entire ingress block because inner for_each is empty.

💡 Hint

Empty for_each in a dynamic block results in no blocks generated for that level.

When the inner dynamic block's for_each is empty, no cidr_blocks blocks are created inside each ingress block. The ingress blocks still exist but without cidr_blocks attribute.

❓ Architecture

advanced

Designing nested dynamic blocks for multi-tier infrastructure

You want to use Terraform nested dynamic blocks to define a multi-tier AWS security group where each tier has multiple ingress rules and each ingress rule can have multiple CIDR blocks. Which structure best represents this nested dynamic block usage?

A One dynamic block for tiers, inside it a dynamic block for ingress rules, inside that a dynamic block for CIDR blocks.

B One dynamic block for ingress rules, inside it a dynamic block for tiers, inside that a dynamic block for CIDR blocks.

C Separate static blocks for tiers, ingress rules, and CIDR blocks without dynamic blocks.

D One dynamic block for CIDR blocks, inside it a dynamic block for ingress rules, inside that a dynamic block for tiers.

💡 Hint

Think about the hierarchy: tiers contain ingress rules, which contain CIDR blocks.

The correct nesting order is tiers > ingress rules > CIDR blocks, so nested dynamic blocks should follow this order to represent the hierarchy properly.

❓ security

advanced

Security implications of nested dynamic blocks in Terraform

What is a potential security risk when using nested dynamic blocks to generate AWS IAM policies dynamically from user input variables?

A Unintended broad permissions if user input is not validated, leading to privilege escalation.

B Terraform will block any dynamic block that uses user input variables for security reasons.

C Nested dynamic blocks cause IAM policies to be ignored by AWS, reducing security.

D There is no security risk because Terraform validates all IAM policy content automatically.

💡 Hint

Consider what happens if user input is not controlled or sanitized.

If user input variables are used directly in nested dynamic blocks to build IAM policies, malicious or incorrect input can create overly permissive policies, risking privilege escalation.

✅ Best Practice

expert

Optimizing nested dynamic blocks for maintainability and performance

Which practice is best to optimize Terraform configurations that use deeply nested dynamic blocks to manage complex resources?

A Write all nested dynamic blocks inline in a single resource block for clarity.

B Break down nested dynamic blocks into reusable modules and use locals to simplify expressions.

C Avoid using dynamic blocks altogether and write static blocks for every possible combination.

D Use nested dynamic blocks with complex for_each expressions directly referencing remote state outputs.

💡 Hint

Think about code reuse and readability in large Terraform projects.

Breaking complex nested dynamic blocks into smaller reusable modules and using locals to simplify expressions improves maintainability and reduces errors.

Practice

1.

What is the main purpose of using nested dynamic blocks in Terraform?

easy

A. To write static configuration without loops

B. To create repeated blocks inside other repeated blocks dynamically

C. To define provider settings only

D. To manage Terraform state files

Solution

1. Step 1: Understand dynamic blocks

   Dynamic blocks allow repeating a block multiple times based on a list or map.

2. Step 2: Understand nested dynamic blocks

   Nested dynamic blocks repeat blocks inside other repeated blocks, useful for complex nested lists.

3. Final Answer:

   To create repeated blocks inside other repeated blocks dynamically -> Option B

4. Quick Check:

   Nested dynamic blocks = repeated blocks inside repeated blocks [OK]

Hint: Think of loops inside loops for nested resources [OK]

Common Mistakes:

• Confusing dynamic blocks with static blocks
• Using nested dynamic blocks for simple flat lists
• Thinking dynamic blocks manage state files

2.

Which of the following is the correct syntax to start a nested dynamic block named subnet inside a dynamic block named network?

dynamic "network" {
  for_each = var.networks
  content {
    name = network.value.name
    // What goes here?
  }
}

easy

A. dynamic "subnet" { for_each = network.value.subnets content { cidr_block = subnet.value } }

B. dynamic subnet { for_each = network.value.subnets content { cidr_block = subnet.value } }

C. dynamic "subnet" for_each = network.value.subnets { content { cidr_block = subnet.value } }

D. dynamic "subnet" { for_each = var.subnets content { cidr_block = subnet.value } }

Solution

1. Step 1: Identify correct dynamic block syntax

   Dynamic blocks require the keyword dynamic, block name in quotes, then for_each and content blocks.

2. Step 2: Check nested dynamic block context

   Inside the network dynamic block, use network.value.subnets for for_each and define content with subnet.value.

3. Final Answer:

   dynamic "subnet" { for_each = network.value.subnets content { cidr_block = subnet.value } } -> Option A

4. Quick Check:

   Correct syntax uses quotes and nested for_each [OK]

Hint: Remember dynamic block name must be in quotes [OK]

Common Mistakes:

• Omitting quotes around block name
• Using wrong variable for for_each
• Placing for_each outside the braces

3.

Given the following Terraform snippet, what will be the value of resource.aws_vpc.example tags after deployment?

variable "vpcs" {
  default = [
    { name = "vpc1", tags = ["tag1", "tag2"] },
    { name = "vpc2", tags = ["tag3"] }
  ]
}

resource "aws_vpc" "example" {
  for_each = { for v in var.vpcs : v.name => v }
  cidr_block = "10.0.0.0/16"

  dynamic "tags" {
    for_each = each.value.tags
    content {
      key   = tags.value
      value = "true"
    }
  }
}

medium

A. Tags will be empty because tags block is not supported inside aws_vpc

B. {"tags" = ["tag1", "tag2"]} for vpc1 and {"tags" = ["tag3"]} for vpc2

C. No tags will be created because dynamic blocks cannot be nested

D. {"tag1" = "true", "tag2" = "true"} for vpc1 and {"tag3" = "true"} for vpc2

Solution

1. Step 1: Understand for_each on resource

   Resource creates two VPCs named vpc1 and vpc2 with their respective tags list.

2. Step 2: Analyze nested dynamic block for tags

   Dynamic block iterates over each.value.tags, creating a tag key with value "true" for each tag string.

3. Final Answer:

   {"tag1" = "true", "tag2" = "true"} for vpc1 and {"tag3" = "true"} for vpc2 -> Option D

4. Quick Check:

   Dynamic tags create key-value pairs from list items [OK]

Hint: Dynamic blocks create repeated nested blocks from lists [OK]

Common Mistakes:

• Assuming tags remain as list instead of key-value map
• Thinking dynamic blocks cannot be nested
• Ignoring the for_each on resource

4.

Identify the error in this nested dynamic block snippet:

dynamic "network" {
  for_each = var.networks
  content {
    name = network.value.name
    dynamic "subnet" {
      for_each = var.subnets
      content {
        cidr_block = subnet.value.cidr
      }
    }
  }
}

medium

A. Incorrect use of content block inside dynamic

B. Missing quotes around subnet in dynamic block

C. Using var.subnets instead of network.value.subnets for nested for_each

D. network.value.name is invalid syntax

Solution

1. Step 1: Check nested for_each source

   The nested dynamic block should iterate over subnets related to the current network, not the entire var.subnets list.

2. Step 2: Confirm correct variable usage

   Using var.subnets ignores the current network context; it should be network.value.subnets to nest properly.

3. Final Answer:

   Using var.subnets instead of network.value.subnets for nested for_each -> Option C

4. Quick Check:

   Nested for_each must use parent block's value [OK]

Hint: Nested loops must use parent block's current item [OK]

Common Mistakes:

• Using global variables instead of nested context
• Forgetting quotes around dynamic block names
• Misplacing content blocks

5.

You have a variable var.services which is a list of maps. Each map has a name and a list of ports. You want to create an aws_security_group resource with nested dynamic blocks to create ingress rules for each port of each service. Which Terraform code snippet correctly implements this?

hard

A. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

B. resource "aws_security_group" "example" {
for_each = var.services
name = each.value.name

dynamic ingress {
for_each = each.value.ports
content {
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

C. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ports.value
to_port = ports.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

D. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ingress.key
to_port = ingress.key
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

Solution

1. Step 1: Use for_each on resource with map keyed by service name

   This allows referencing each service by name with each.key and each.value.

2. Step 2: Use nested dynamic block for ingress rules

   Dynamic block named "ingress" iterates over each.value.ports with for_each and uses ingress.value for port numbers.

3. Final Answer:

   Code snippet in Option A correctly uses nested dynamic blocks with proper variable references -> Option A

4. Quick Check:

   Nested dynamic blocks need correct for_each and value references [OK]

Hint: Use each.value and ingress.value inside nested dynamic blocks [OK]

Common Mistakes:

• Omitting quotes around dynamic block name
• Using wrong variable names like ports.value instead of ingress.value
• Not using map for resource for_each