Nested dynamic blocks in Terraform - Mini Project: Build & Apply

Nested dynamic blocks

📖 Scenario: You are setting up a cloud infrastructure using Terraform. You need to create a resource that has nested blocks which are generated dynamically based on input variables. This is common when configuring complex cloud resources like load balancers or security groups.

🎯 Goal: Build a Terraform configuration that uses nested dynamic blocks to create multiple nested blocks inside a resource. You will first define the data structure, then create the dynamic blocks for the inner and outer levels.

📋 What You'll Learn

Create a variable listeners with a list of maps, each map containing port and protocol keys

Create a variable rules with a list of maps, each map containing host and paths keys, where paths is a list of strings

Use a dynamic block named listener to iterate over listeners

Inside each listener block, use a nested dynamic block named rule to iterate over rules

Inside each rule block, use a nested dynamic block named path to iterate over the paths list

💡 Why This Matters

🌍 Real World

Cloud engineers often need to configure resources with multiple nested settings that vary by environment or input. Nested dynamic blocks let them write flexible, reusable Terraform code.

💼 Career

Understanding nested dynamic blocks is essential for Terraform users working in cloud infrastructure roles, enabling them to automate complex resource setups efficiently.

1

Define the listeners variable

Create a Terraform variable called listeners of type list with two maps. The first map should have port = 80 and protocol = "HTTP". The second map should have port = 443 and protocol = "HTTPS".

Terraform

# Define the variable listeners with two maps
# Your code here

Hint

Use variable "listeners" with type = list(object({ port = number, protocol = string })) and set the default to the two maps.

2

Define the rules variable with nested paths

Create a Terraform variable called rules of type list with two maps. The first map should have host = "example.com" and paths = ["/", "/app"]. The second map should have host = "test.com" and paths = ["/test"].

Terraform

variable "listeners" {
  type = list(object({
    port     = number
    protocol = string
  }))
  default = [
    { port = 80, protocol = "HTTP" },
    { port = 443, protocol = "HTTPS" }
  ]
}

# Define the variable rules with two maps including paths
# Your code here

Hint

Use variable "rules" with type = list(object({ host = string, paths = list(string) })) and set the default to the two maps.

3

Create the outer dynamic "listener" block

Inside a resource aws_lb named example, add a dynamic "listener" block that iterates over var.listeners. For each listener, set port and protocol attributes using listener.value.port and listener.value.protocol.

Terraform

variable "listeners" {
  type = list(object({
    port     = number
    protocol = string
  }))
  default = [
    { port = 80, protocol = "HTTP" },
    { port = 443, protocol = "HTTPS" }
  ]
}

variable "rules" {
  type = list(object({
    host  = string
    paths = list(string)
  }))
  default = [
    { host = "example.com", paths = ["/", "/app"] },
    { host = "test.com", paths = ["/test"] }
  ]
}

resource "aws_lb" "example" {
  name               = "example-lb"
  internal           = false
  load_balancer_type = "application"
  subnets            = ["subnet-12345", "subnet-67890"]

  # Add a dynamic block named listener iterating over var.listeners
  # Your code here
}

Hint

Use dynamic "listener" with for_each = var.listeners and set port and protocol inside content.

4

Add nested dynamic "rule" and dynamic "path" blocks inside listener

Inside the content block of the dynamic "listener", add a nested dynamic "rule" block that iterates over var.rules. Inside each rule block, set host to rule.value.host. Then add a nested dynamic "path" block inside rule that iterates over rule.value.paths. Inside path, set value to path.value.

Terraform

variable "listeners" {
  type = list(object({
    port     = number
    protocol = string
  }))
  default = [
    { port = 80, protocol = "HTTP" },
    { port = 443, protocol = "HTTPS" }
  ]
}

variable "rules" {
  type = list(object({
    host  = string
    paths = list(string)
  }))
  default = [
    { host = "example.com", paths = ["/", "/app"] },
    { host = "test.com", paths = ["/test"] }
  ]
}

resource "aws_lb" "example" {
  name               = "example-lb"
  internal           = false
  load_balancer_type = "application"
  subnets            = ["subnet-12345", "subnet-67890"]

  dynamic "listener" {
    for_each = var.listeners
    content {
      port     = listener.value.port
      protocol = listener.value.protocol

      # Add a nested dynamic block named rule iterating over var.rules
      # Inside rule, set host to rule.value.host
      # Inside rule, add a nested dynamic block named path iterating over rule.value.paths
      # Inside path, set value to path.value
      # Your code here
    }
  }
}

Hint

Inside listener content, add dynamic "rule" with for_each = var.rules. Inside rule content, set host = rule.value.host and add dynamic "path" with for_each = rule.value.paths. Inside path content, set value = path.value.

Practice

1.

What is the main purpose of using nested dynamic blocks in Terraform?

easy

A. To write static configuration without loops

B. To create repeated blocks inside other repeated blocks dynamically

C. To define provider settings only

D. To manage Terraform state files

Solution

1. Step 1: Understand dynamic blocks

   Dynamic blocks allow repeating a block multiple times based on a list or map.

2. Step 2: Understand nested dynamic blocks

   Nested dynamic blocks repeat blocks inside other repeated blocks, useful for complex nested lists.

3. Final Answer:

   To create repeated blocks inside other repeated blocks dynamically -> Option B

4. Quick Check:

   Nested dynamic blocks = repeated blocks inside repeated blocks [OK]

Hint: Think of loops inside loops for nested resources [OK]

Common Mistakes:

• Confusing dynamic blocks with static blocks
• Using nested dynamic blocks for simple flat lists
• Thinking dynamic blocks manage state files

2.

Which of the following is the correct syntax to start a nested dynamic block named subnet inside a dynamic block named network?

dynamic "network" {
  for_each = var.networks
  content {
    name = network.value.name
    // What goes here?
  }
}

easy

A. dynamic "subnet" { for_each = network.value.subnets content { cidr_block = subnet.value } }

B. dynamic subnet { for_each = network.value.subnets content { cidr_block = subnet.value } }

C. dynamic "subnet" for_each = network.value.subnets { content { cidr_block = subnet.value } }

D. dynamic "subnet" { for_each = var.subnets content { cidr_block = subnet.value } }

Solution

1. Step 1: Identify correct dynamic block syntax

   Dynamic blocks require the keyword dynamic, block name in quotes, then for_each and content blocks.

2. Step 2: Check nested dynamic block context

   Inside the network dynamic block, use network.value.subnets for for_each and define content with subnet.value.

3. Final Answer:

   dynamic "subnet" { for_each = network.value.subnets content { cidr_block = subnet.value } } -> Option A

4. Quick Check:

   Correct syntax uses quotes and nested for_each [OK]

Hint: Remember dynamic block name must be in quotes [OK]

Common Mistakes:

• Omitting quotes around block name
• Using wrong variable for for_each
• Placing for_each outside the braces

3.

Given the following Terraform snippet, what will be the value of resource.aws_vpc.example tags after deployment?

variable "vpcs" {
  default = [
    { name = "vpc1", tags = ["tag1", "tag2"] },
    { name = "vpc2", tags = ["tag3"] }
  ]
}

resource "aws_vpc" "example" {
  for_each = { for v in var.vpcs : v.name => v }
  cidr_block = "10.0.0.0/16"

  dynamic "tags" {
    for_each = each.value.tags
    content {
      key   = tags.value
      value = "true"
    }
  }
}

medium

A. Tags will be empty because tags block is not supported inside aws_vpc

B. {"tags" = ["tag1", "tag2"]} for vpc1 and {"tags" = ["tag3"]} for vpc2

C. No tags will be created because dynamic blocks cannot be nested

D. {"tag1" = "true", "tag2" = "true"} for vpc1 and {"tag3" = "true"} for vpc2

Solution

1. Step 1: Understand for_each on resource

   Resource creates two VPCs named vpc1 and vpc2 with their respective tags list.

2. Step 2: Analyze nested dynamic block for tags

   Dynamic block iterates over each.value.tags, creating a tag key with value "true" for each tag string.

3. Final Answer:

   {"tag1" = "true", "tag2" = "true"} for vpc1 and {"tag3" = "true"} for vpc2 -> Option D

4. Quick Check:

   Dynamic tags create key-value pairs from list items [OK]

Hint: Dynamic blocks create repeated nested blocks from lists [OK]

Common Mistakes:

• Assuming tags remain as list instead of key-value map
• Thinking dynamic blocks cannot be nested
• Ignoring the for_each on resource

4.

Identify the error in this nested dynamic block snippet:

dynamic "network" {
  for_each = var.networks
  content {
    name = network.value.name
    dynamic "subnet" {
      for_each = var.subnets
      content {
        cidr_block = subnet.value.cidr
      }
    }
  }
}

medium

A. Incorrect use of content block inside dynamic

B. Missing quotes around subnet in dynamic block

C. Using var.subnets instead of network.value.subnets for nested for_each

D. network.value.name is invalid syntax

Solution

1. Step 1: Check nested for_each source

   The nested dynamic block should iterate over subnets related to the current network, not the entire var.subnets list.

2. Step 2: Confirm correct variable usage

   Using var.subnets ignores the current network context; it should be network.value.subnets to nest properly.

3. Final Answer:

   Using var.subnets instead of network.value.subnets for nested for_each -> Option C

4. Quick Check:

   Nested for_each must use parent block's value [OK]

Hint: Nested loops must use parent block's current item [OK]

Common Mistakes:

• Using global variables instead of nested context
• Forgetting quotes around dynamic block names
• Misplacing content blocks

5.

You have a variable var.services which is a list of maps. Each map has a name and a list of ports. You want to create an aws_security_group resource with nested dynamic blocks to create ingress rules for each port of each service. Which Terraform code snippet correctly implements this?

hard

A. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

B. resource "aws_security_group" "example" {
for_each = var.services
name = each.value.name

dynamic ingress {
for_each = each.value.ports
content {
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

C. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ports.value
to_port = ports.value
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

D. resource "aws_security_group" "example" {
for_each = { for s in var.services : s.name => s }
name = each.key

dynamic "ingress" {
for_each = each.value.ports
content {
from_port = ingress.key
to_port = ingress.key
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
}

Solution

1. Step 1: Use for_each on resource with map keyed by service name

   This allows referencing each service by name with each.key and each.value.

2. Step 2: Use nested dynamic block for ingress rules

   Dynamic block named "ingress" iterates over each.value.ports with for_each and uses ingress.value for port numbers.

3. Final Answer:

   Code snippet in Option A correctly uses nested dynamic blocks with proper variable references -> Option A

4. Quick Check:

   Nested dynamic blocks need correct for_each and value references [OK]

Hint: Use each.value and ingress.value inside nested dynamic blocks [OK]

Common Mistakes:

• Omitting quotes around dynamic block name
• Using wrong variable names like ports.value instead of ingress.value
• Not using map for resource for_each