AWS provider Dynamic HCL Configuration Practice Test 2 — 15 Questions

Question 1

You are using a dynamic block to generate multiple ingress rules for an AWS security group. The dynamic block iterates over a list of objects containing port, protocol, and cidr_blocks. Which two statements are true regarding the use of dynamic blocks in this scenario? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The dynamic block's content block can reference attributes of the current iteration using the iterator object, such as rule.value.port.. The iterator argument allows renaming the default iterator object, and the content block can reference the current iteration's value through that iterator. These two features are essential for writing flexible dynamic blocks. The other statements are incorrect because dynamic blocks can accept lists, can be conditionally included, and nested blocks do not always require unique iterator names unless there is a naming conflict.

Answer

Dynamic blocks can be nested arbitrarily deep, but each nested dynamic block must use a unique iterator name to avoid conflicts.

Answer

The for_each argument in a dynamic block must be a map or a set of strings; it cannot accept a list of objects directly.

Answer

The dynamic block can generate multiple instances of the nested block, but it cannot conditionally include the block based on a condition.

Question 2

A platform team stores environment definitions in a single variable "envs" typed as map(object({ region = string, instance_type = string, tags = map(string) })). They need to build locals for downstream modules. Which TWO local definitions correctly produce, respectively, a map of instance types keyed by environment name and a set of all distinct tag values across every environment? (Choose two.)

Accepted Answer

tag_values = distinct(flatten([for cfg in var.envs : values(cfg.tags)])). The two working definitions combine a map-preserving for expression for the keyed instance-type map with a nested for expression plus flatten() and distinct() for the tag-value collection. The map form requires name, cfg to retain environment keys, while flatten() collapses the per-environment value lists before deduplication. Together they satisfy both requested locals without losing keys or duplicating values.

Answer

tag_values = flatten([for cfg in var.envs : cfg.tags])

Answer

instance_types = [for name, cfg in var.envs : cfg.instance_type]

Answer

tag_values = setproduct([for cfg in var.envs : keys(cfg.tags)])

Question 3

A platform team stores environment configuration in a single Terraform variable `env_config` of type `map(object({ cidr_block = string, az_count = number }))`. They want to create one `aws_subnet` per availability zone in each environment, with the subnet CIDR computed by calling `cidrsubnet` on the environment's `cidr_block`. Which expression produces a flattened collection suitable for `for_each` on `aws_subnet`, where each element's key uniquely identifies the environment and AZ index?

Accepted Answer

flatten([for env, cfg in var.env_config : [for i in range(cfg.az_count) : { key = "${env}-${i}", cidr = cidrsubnet(cfg.cidr_block, 8, i) }]]). Building a unique key per subnet requires a nested `for` that expands each environment into its AZ indices, then `flatten` to produce a single list. Each element carries a composite key such as environment plus index, which can be converted to a map for `for_each`. This preserves per-environment CIDR math with `cidrsubnet` and yields stable keys across plans.

Answer

zipmap(keys(var.env_config), [for cfg in values(var.env_config) : cidrsubnet(cfg.cidr_block, 8, 0)])

Answer

for env, cfg in var.env_config : env => cfg.cidr_block

Answer

merge([for env, cfg in var.env_config : { env = env, cidr = cfg.cidr_block }]...)

Question 4

You are creating a Terraform module that must accept a list of objects representing AWS IAM policy statements. Each object has `effect`, `actions` (list of strings), and `resources` (list of strings). You want to validate that all `actions` and `resources` are non-empty lists and that `effect` is either "Allow" or "Deny". Which TWO of the following validation approaches are valid and correctly enforce these requirements? (Choose two.)

Accepted Answer

Use a precondition in a data source that references the variable, with condition = alltrue([for stmt in var.statements : contains(["Allow", "Deny"], stmt.effect) && length(stmt.actions) > 0 && length(stmt.resources) > 0]). The requirements demand validation of every statement's actions, resources, and effect. Using alltrue with a for expression that checks all three conditions per statement is correct. This can be placed in a variable validation block or a precondition. Approaches that only check the first element or omit content checks fail to enforce the rules for all statements.

Answer

Define the variable type as list(object({ effect = string, actions = list(string), resources = list(string) })) and add a validation block with condition = can(regex("^(Allow|Deny)$", var.statements[0].effect))

Answer

Use a validation block with condition = length(var.statements) > 0

Answer

Use a validation block with condition = alltrue([for stmt in var.statements : length(stmt.actions) > 0 && length(stmt.resources) > 0]) && contains(["Allow", "Deny"], var.statements[0].effect)

Question 5

A configuration builds a local "az_map" with local.az_map = { for idx, az in data.aws_availability_zones.available.names : az => idx } and then uses for_each = local.az_map on aws_subnet resources. A reviewer asks what the resulting resource instance keys and values look like, and what happens if AWS later reorders the availability zone list. Which statement is accurate?

Accepted Answer

Resource keys are the availability zone names and each instance's each.value is the zone's index in the data source list; reordering the list changes only the values, not the key set.. In a for expression over a list, the first symbol is the index and the second is the element. Here the element (zone name) becomes the map key and the index becomes the value, so for_each addresses each subnet by zone name. Reordering the source list preserves the key set and only shifts the numeric values, keeping resource addresses stable.

Answer

Resource keys are numeric indices and each instance's each.value is the availability zone name; reordering the list causes every resource to be replaced.

Answer

Resource keys are the availability zone names and each instance's each.value is the full data source object for that zone, so reordering has no effect on values.

Answer

Resource keys are the availability zone names and each instance's each.value is the zone's index in the data source list; reordering the list changes which zone maps to which key.

Question 6

A configuration uses `for_each = toset(var.bucket_names)` on an `aws_s3_bucket` resource, where `var.bucket_names` is a `list(string)`. A teammate later reorders the list in a `.tfvars` file, and the plan shows unexpected bucket replacements. The team wants to keep using the list but avoid reordering churn. Which change best addresses the root cause while preserving the ability to add or remove buckets?

Accepted Answer

Change the variable type to `set(string)` so Terraform treats the values as an unordered collection.. The churn comes from list order affecting `toset` keys only if duplicates or ordering matter, but the real fix is to make the variable a set so identity is value-based. With a set, each bucket's key is its name, so reordering input has no effect. Adding or removing a name affects only that instance, which is the desired behavior.

Answer

Use `for_each = { for i, name in var.bucket_names : i => name }` to map indices to names.

Answer

Switch to `count = length(var.bucket_names)` and reference `count.index`.

Answer

Add `lifecycle { create_before_destroy = true }` to the bucket resource.

Question 7

You are authoring a module that creates multiple AWS S3 buckets. The module receives a variable `bucket_configs` defined as `map(object({ versioning = bool, tags = map(string) }))`. You need to conditionally enable versioning only when the `versioning` attribute is true, and you also need to set tags dynamically from the object. Which combination of Terraform language features should you use to achieve this with minimal repetition?

Accepted Answer

Use `for_each = var.bucket_configs` on the resource, set `tags = each.value.tags`, and use a `dynamic "versioning"` block with `for_each = each.value.versioning ? [1] : []` and `content { enabled = true }`.. The correct answer uses `for_each` to iterate over the map, allowing access to both key and value. The `dynamic` block with a conditional list is the idiomatic way to conditionally include a nested block. Setting tags directly from the object attribute avoids unnecessary complexity. The other options either misuse `count` with a map, incorrectly use `dynamic` for a boolean, or fail to conditionally omit the versioning block.

Answer

Use `for_each = var.bucket_configs` on the resource, set `tags = each.value.tags`, and set `versioning { enabled = each.value.versioning }` directly without a dynamic block.

Answer

Use `for_each` over `bucket_configs` to create the buckets, and inside the resource use `dynamic "versioning"` blocks with `for_each = var.bucket_configs[each.key].versioning ? [1] : []` and `dynamic "tags"` with `for_each = var.bucket_configs[each.key].tags`.

Answer

Use `count` over `bucket_configs` to create the buckets, and inside the resource use `dynamic "versioning"` blocks with `for_each = var.bucket_configs[count.index].versioning ? [1] : []` and set tags with `tags = var.bucket_configs[count.index].tags`.

Question 8

You are using a `dynamic` block to generate multiple `ingress` rules for an AWS security group. The variable `ingress_rules` is a list of objects, each with `from_port`, `to_port`, and `cidr_blocks`. You need to ensure that the `cidr_blocks` attribute inside each generated `ingress` block is set correctly. Which TWO of the following statements about the `content` block within a `dynamic` block are true? (Choose two.)

Accepted Answer

The `content` block can contain nested `dynamic` blocks to further generate nested blocks, such as generating multiple `cidr_blocks` if the attribute is a list of lists.. The correct statements are that the `content` block can contain nested `dynamic` blocks, allowing for complex nested structures, and that it can reference outer scope variables directly. The other statements are false: the `each` object is not used; instead, the iterator variable (e.g., `ingress`) is used. The `content` block is required, not optional. And it can contain nested blocks, not just arguments.

Answer

The `content` block must use the `each` object to reference the current element of the `for_each` collection, and `each.key` and `each.value` are available.

Answer

The `content` block is optional; if omitted, the dynamic block will generate empty blocks for each element in the `for_each` collection.

Answer

The `content` block can only contain arguments, not nested blocks, so you cannot generate nested blocks within it.

Question 9

You are attempting to use a conditional expression to set a variable, but the types returned by the true and false results differ. What happens?

Accepted Answer

A type mismatch error is returned. In Terraform, a conditional expression requires both the true and false results to be of the same type. If they differ, Terraform returns a type mismatch error during evaluation. This is because Terraform's type system is strict and does not perform implicit type coercion in conditional expressions.

Answer

The result is coerced to a string

Answer

It defaults to the true result type

Answer

Terraform automatically casts to the most flexible type

Question 10

You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?

Accepted Answer

for expression. A for expression is the correct tool to transform a list of objects into a map, using the syntax { for item in list : key => value }, which is exactly what for_each requires (a map or set of strings). Functions like merge() combine existing maps but cannot reshape a list of objects into a map keyed by an attribute. The for expression is the idiomatic Terraform construct for this transformation.

Answer

tolist()

Answer

flatten()

Answer

merge()

Question 11

In a dynamic block, you need to access the current iteration item. What is the default label assigned to the iterator object?

Accepted Answer

The name of the block. In a dynamic block, the iterator object defaults to the name of the block being generated. For `dynamic "ingress" { ... }`, the iterator is `ingress`, so you reference `ingress.value` and `ingress.key`. You can override this with the `iterator` argument, but the default is the block label. This is why `each.value` and `count.index` are not used inside dynamic blocks.

Answer

count.index

Answer

each.value

Answer

item

Question 12

When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?

Accepted Answer

each.value. When a resource uses for_each, Terraform iterates over a map or set and exposes the current element through the each object. each.value returns the value of the current map entry (or the set member itself when iterating a set), which is what you reference inside the resource block to configure per-instance attributes. This is the standard mechanism for deriving unique names, tags, or settings for each instance created by the loop.

Answer

each.key

Answer

item.value

Answer

count.index

Question 13

Which function is most useful when you have a nested list of objects and want to create a single flat list to iterate over with for_each?

Accepted Answer

flatten(). The flatten() function takes a nested list (list of lists) and returns a single flat list containing all elements. When you have a nested list of objects and want to iterate with for_each, flatten() collapses the nesting so each object becomes a top-level element that for_each can key on. This is the idiomatic Terraform pattern for iterating over nested collections.

Answer

concat()

Answer

lookup()

Answer

merge()

Question 14

You want to optionally create an S3 bucket only if a specific variable 'create_bucket' is set to true. Which HCL feature is best for this?

Accepted Answer

conditional expression (ternary). The conditional expression (ternary) in HCL uses the syntax `condition ? true_val : false_val` and can be applied to a resource's `count` argument, e.g., `count = var.create_bucket ? 1 : 0`. This is the idiomatic way to conditionally create a resource based on a boolean variable. When `create_bucket` is true, one instance is created; when false, zero instances are created.

Answer

try()

Answer

dynamic block

Answer

for_each

Question 15

You are creating a security group in AWS and need to define multiple ingress rules based on a list of port numbers. Which meta-argument is most appropriate to use to create one resource instance per port?

Accepted Answer

for_each. The for_each meta-argument accepts a map or set of strings and creates one resource instance per element, making it the correct choice when iterating over a list of port numbers (converted to a set or map). Unlike count, for_each produces stable, keyed instance addresses (e.g., aws_security_group_rule.ingress["22"]) so adding or removing a port doesn't cause unrelated rules to be destroyed and recreated. This is the idiomatic Terraform pattern for defining multiple ingress rules from a collection of ports.

Answer

instance_count

Answer

count

Answer

dynamic