Variable validation blocks in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the correct validation block for a variable

Given the following Terraform variable declaration, which validation block correctly ensures the variable 'environment' only accepts the values 'dev', 'staging', or 'prod'?

Terraform

variable "environment" {
  type = string
  description = "Deployment environment"
  validation {
    condition     = ???
    error_message = "Environment must be one of: dev, staging, prod."
  }
}

A condition = contains(["dev", "staging", "prod"], var.environment)

B condition = var.environment == "dev" || var.environment == "staging" || var.environment == "prod"

C condition = var.environment in ["dev", "staging", "prod"]

D condition = var.environment matches "dev|staging|prod"

💡 Hint

Use a function that checks if a list contains a value.

The 'contains' function checks if the list includes the variable value. Option A uses 'contains' correctly. Option A is valid Terraform syntax but less concise. Option A uses 'in' which is not valid in Terraform expressions. Option A uses 'matches' which is not a Terraform function.

❓ service_behavior

intermediate

What happens when a variable fails validation?

In Terraform, if a variable's validation block condition evaluates to false during plan or apply, what is the expected behavior?

A Terraform continues applying changes but logs a warning.

B Terraform stops and shows the error_message from the validation block.

C Terraform ignores the validation and uses the default value if set.

D Terraform replaces the invalid value with null and continues.

💡 Hint

Think about how Terraform enforces input correctness.

Terraform halts execution and displays the error_message when validation fails to prevent invalid configurations.

❓ Architecture

advanced

Designing variable validation for CIDR blocks

You want to validate a Terraform variable 'network_cidr' to ensure it is a valid CIDR block (e.g., '10.0.0.0/16'). Which validation condition correctly uses Terraform functions to check this?

A condition = can(cidrsubnet(var.network_cidr, 8, 1))

B condition = length(regexall("^\\d+\\.\\d+\\.\\d+\\.\\d+/\\d+$", var.network_cidr)) > 0

C condition = var.network_cidr != ""

D condition = can(cidrhost(var.network_cidr, 0))

💡 Hint

Use 'can' with a function that parses CIDR blocks.

Option A uses 'can' with 'cidrsubnet' which returns a subnet CIDR if input is valid, so it validates the CIDR format. Option A uses 'cidrhost' which expects a valid CIDR but may fail for some inputs. Option A uses regex which is error-prone and not recommended. Option A only checks non-empty string, not CIDR format.

❓ security

advanced

Validating sensitive variable length

You have a sensitive Terraform variable 'api_key' that must be exactly 32 characters long. Which validation block condition correctly enforces this?

A condition = length(var.api_key) == 32

B condition = var.api_key matches "^[a-zA-Z0-9]{32}$"

C condition = can(length(var.api_key)) && length(var.api_key) == 32

D condition = var.api_key != null && length(var.api_key) >= 32

💡 Hint

Use 'can' to safely check length on sensitive variables.

Option C uses 'can' to avoid errors if the variable is null or invalid, then checks length equals 32. Option C may error if var.api_key is null. Option C allows length greater than 32, not exact. Option C uses 'matches' which is not a Terraform function.

✅ Best Practice

expert

Choosing the best validation for a list variable

You have a Terraform variable 'allowed_ports' of type list(number). You want to validate that all ports are between 1024 and 65535 inclusive. Which validation condition correctly enforces this for every element in the list?

A condition = can(alltrue([for p in var.allowed_ports : p >= 1024 && p <= 65535]))

B condition = length([for p in var.allowed_ports : p >= 1024 && p <= 65535]) == length(var.allowed_ports)

C condition = all([for p in var.allowed_ports : p >= 1024 && p <= 65535])

D condition = alltrue([for p in var.allowed_ports : p >= 1024 && p <= 65535])

💡 Hint

Use the correct function that returns true if all elements satisfy a condition.

Option D uses 'alltrue' which returns true if all booleans in the list are true. Option D uses 'all' with only one argument, which is invalid syntax as 'all' requires a collection and a condition expression. Option D compares the length of the boolean list comprehension to the original list length, but this always equals regardless of the values. Option D wraps a valid expression in 'can', which is unnecessary.