AWS provider Dynamic HCL Configuration Practice Test 4 — 15 Questions

Question 1

You are authoring a Terraform configuration that provisions an aws_autoscaling_group. The desired instance count is stored in a variable named instance_count, and you need to create exactly that many aws_instance resources. Which approach correctly creates the required number of instances while keeping the configuration valid?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the count meta-argument with count = var.instance_count on the aws_instance resource.. The count meta-argument is designed to create a specified number of identical resource instances. Because the desired quantity is a numeric variable, count = var.instance_count directly produces exactly that many aws_instance resources. The other options either misuse meta-arguments that expect different input types or confuse block-level repetition with resource-level repetition.

Answer

Use the for_each meta-argument with for_each = var.instance_count on the aws_instance resource.

Answer

Use the depends_on meta-argument with depends_on = [var.instance_count] on the aws_instance resource.

Answer

Use a dynamic block inside the aws_instance resource with for_each = range(var.instance_count).

Question 2

Your team manages AWS infrastructure with Terraform. A module needs to accept a map of environment names to instance types, where each instance type must be one of a fixed set of allowed values. You want Terraform to reject invalid configurations during plan with a clear error message. Which approach best validates the variable input?

Accepted Answer

Define the variable with type = map(string) and add a validation block with a condition that checks each value against the allowed list using the contains function and alltrue.. Variable validation blocks allow you to enforce custom constraints on input variables. By using a condition that checks all values in the map against a list of allowed instance types, you ensure that invalid configurations are caught during plan with a helpful error message. This is the intended way to validate complex variable inputs in Terraform.

Answer

Define the variable with type = map(string) and use a lifecycle precondition on each AWS instance resource that checks the instance type.

Answer

Define the variable with type = map(string) and add a custom validation using the file function to read a list of allowed values from an external file.

Answer

Define the variable with type = map(string) and rely on the AWS provider to reject invalid instance types when the plan is applied.

Question 3

You are writing a Terraform configuration that reads a list of environment names from a variable and creates one aws_s3_bucket for each environment. The order of the list may change over time, and you want to avoid unnecessary bucket replacement. Which configuration snippet achieves this with stable resource addressing?

Accepted Answer

resource "aws_s3_bucket" "env" { for_each = toset(var.environments) bucket = each.value }. To achieve stable resource addressing when order may change, the resource instances must be keyed by a value that does not depend on list position. Using for_each with toset(var.environments) creates instances keyed by the environment names themselves, so reordering the input list does not alter the resource addresses. The count-based approaches all depend on index positions and therefore do not provide stability.

Answer

resource "aws_s3_bucket" "env" { count = length(var.environments) bucket = element(var.environments, count.index) }

Answer

resource "aws_s3_bucket" "env" { for_each = var.environments bucket = each.value }

Answer

resource "aws_s3_bucket" "env" { count = length(var.environments) bucket = var.environments[count.index] }

Question 4

You are authoring a Terraform module that creates an AWS IAM policy. The policy's Statement blocks must be generated from a list of objects, but each Statement must also conditionally include a Condition block only when the object's condition attribute is non-null. Which approach correctly generates the Statement blocks while conditionally including the nested Condition block?

Accepted Answer

Use a dynamic "statement" block with for_each over the list, and inside each statement block use a nested dynamic "condition" block with for_each set to a one-element list when the condition attribute is non-null, or an empty list otherwise.. The correct approach uses nested dynamic blocks with conditional for_each to generate optional nested blocks. This is the standard HCL pattern for conditionally including blocks based on input data. It ensures that the Condition block is only present when needed, avoiding invalid policy documents. The other options either misuse data sources, create empty blocks, or rely on provisioners, which are not appropriate for this declarative configuration.

Answer

Use a dynamic "statement" block with for_each over the list, and inside each statement block include a Condition block unconditionally, setting its values to null when not needed.

Answer

Use a for expression to build a list of statement objects, then pass that list directly to the statement argument of the aws_iam_policy_document data source.

Answer

Use a count meta-argument on a null_resource to loop over the list, and use provisioners to construct the policy JSON, then pass it to aws_iam_policy.

Question 5

You maintain a Terraform module that deploys AWS resources into several environments. Rather than declaring a separate variable per environment, you want a single input variable that accepts a map of environment names to configuration objects, where each object contains a region string and an instance count number, and your configuration should reject any input that does not match this shape at plan time. Which variable type constraint should you declare?

Accepted Answer

variable "environments" { type = map(object({ region = string, count = number })) }. A map of objects is the only constraint that simultaneously enforces named environment keys and a fixed attribute schema with region as a string and count as a number. Terraform validates caller input against that schema during planning and converts compatible primitive values automatically, so malformed input fails early rather than producing broken resources later.

Answer

variable "environments" { type = list(object({ region = string, count = number })) }

Answer

variable "environments" { type = map(string) }

Answer

variable "environments" { type = any }

Question 6

You are authoring a Terraform module that must accept a map of environment names to instance counts. The map is provided by callers and may contain up to 20 entries. You need to derive a flat list of instance names in the form "-" (e.g., "prod-0", "prod-1") so that a downstream resource can use `for_each` with stable keys. Which expression correctly produces this list?

Accepted Answer

flatten([for env, count in var.instance_counts : [for i in range(count) : "${env}-${i}"]]). The requirement is to expand each environment's count into individual instance names and then combine them into one flat list. A nested for expression with flatten achieves this by generating a list of names per environment and then merging them. The other options either produce the wrong data shape or fail to expand the count into multiple entries.

Answer

concat([for env, count in var.instance_counts : "${env}-${count}"])

Answer

[for env, count in var.instance_counts : "${env}-${count}"]

Answer

[for env, count in var.instance_counts : { name = "${env}-${count}" }]

Question 7

You are writing a Terraform configuration that creates multiple AWS S3 buckets. The bucket names are derived from a list of project names, but you need to ensure that the names are unique and that the configuration can be safely modified without affecting existing buckets. Which approach should you use?

Accepted Answer

Use for_each with a map where the keys are the project names and the values are the desired bucket configurations.. Using for_each with a map ensures that each resource instance is uniquely identified by its map key, so changes to the map only affect the corresponding instances. This provides stable resource addresses and avoids the pitfalls of count, where reordering or removing elements can cause unintended destruction and recreation of resources.

Answer

Use a for expression to create a list of bucket names and then pass that list to the bucket resource's name argument.

Answer

Use count with the length of the project list and reference each bucket by index.

Answer

Use a dynamic block to generate multiple bucket resources within a single resource block.

Question 8

You are writing a Terraform configuration that uses a dynamic block to generate multiple ingress rules within an aws_security_group resource. The dynamic block iterates over a variable named ingress_rules. Inside the content block, you need to reference the current rule. Which expression correctly accesses the current element?

Accepted Answer

rule.value. Inside a dynamic block, the iterator object is named after the block's label unless an iterator argument is explicitly provided. With a dynamic block labeled rule, the current element is accessed via rule.value. This allows the content block to reference attributes of the current item. The other options confuse the iterator with other meta-argument contexts or with the variable name.

Answer

ingress_rules.value

Answer

each.value

Answer

dynamic.value

Question 9

A configuration defines a dynamic block that generates ingress rules for an aws_security_group from a list of objects. Each object has a from_port, to_port, and protocol attribute, and one object also carries an extra cidr_blocks list. You want every generated rule to include the from_port, to_port, and protocol values, and to include cidr_blocks only when it is present, without writing a separate block for the odd entry. Which approach satisfies this?

Accepted Answer

Add a nested dynamic "cidr_blocks" block inside the ingress content, iterating over rule.value.cidr_blocks with for_each and guarding the iteration with a conditional that yields an empty list when the attribute is null.. A nested dynamic block whose for_each source is guarded by a conditional that returns an empty list when the attribute is null produces inner blocks only for entries that actually carry cidr_blocks, while the outer content always emits the required scalar arguments. This keeps one uniform ingress block definition that adapts to heterogeneous input.

Answer

Declare the variable as a list of maps and rely on Terraform to supply empty defaults for any map keys that are absent.

Answer

Use content with from_port = rule.value.from_port and reference cidr_blocks = rule.value.cidr_blocks inside the same content block.

Answer

Set the iterator argument to a custom label and reference the custom label inside content for all attributes, including cidr_blocks.

Question 10

You are writing a Terraform configuration that uses a for expression to transform a map of objects into a new map. The original map has keys that are strings, and each object contains an attribute 'enabled' of type bool. You need to create a new map that includes only the entries where 'enabled' is true, and the new map's keys should be the original keys prefixed with 'prod-'. Which for expression achieves this?

Accepted Answer

{ for k, v in var.input_map : "prod-${k}" => v if v.enabled }. The correct for expression uses curly braces to produce a map, iterates over the input map, applies an if clause to filter only enabled entries, and transforms the key by prefixing 'prod-'. This meets all requirements: filtering, key transformation, and value preservation. The other options either use incorrect delimiters, omit the key transformation, or alter the value incorrectly.

Answer

[ for k, v in var.input_map : "prod-${k}" => v if v.enabled ]

Answer

{ for k, v in var.input_map : "prod-${k}" => v.enabled }

Answer

{ for k, v in var.input_map : k => v if v.enabled }

Question 11

You have a Terraform variable defined as a list of objects, each with a name and a list of ports. You need to create AWS security group rules for each port across all objects. Which expression correctly generates a flattened list of objects containing the name and port for each combination?

Accepted Answer

flatten([for obj in var.services : [for p in obj.ports : { name = obj.name, port = p }]]). The nested for expression creates an inner list for each service, where each element is an object with the service name and a single port. The flatten function then merges all these inner lists into one flat list. This is the standard pattern for transforming a list of objects with nested lists into a flat list for use with for_each or other iteration.

Answer

concat([for obj in var.services : { name = obj.name, port = obj.ports }])

Answer

merge([for obj in var.services : { (obj.name) = obj.ports }])

Answer

[for obj in var.services : { name = obj.name, port = obj.ports }]

Question 12

You are defining an input variable for a Terraform module that will accept a map of environment names to configuration objects. The object should have an instance_type string and a min_size number. You want Terraform to validate that any provided value matches this structure. Which type constraint should you use for the variable?

Accepted Answer

type = map(object({ instance_type = string, min_size = number })). The requirement is a map where each key is an environment name and each value is an object with specific attributes. The type constraint map(object({ instance_type = string, min_size = number })) expresses exactly that. Terraform will enforce that the variable is a map and that each value conforms to the object schema, catching configuration errors early.

Answer

type = map(string)

Answer

type = object({ instance_type = string, min_size = number })

Answer

type = list(object({ instance_type = string, min_size = number }))

Question 13

A team defines an aws_instance resource whose instance_type should normally come from a variable, but for one specific workspace named "dr" the value must be forced to t3.micro regardless of the variable. The team wants a single resource block that behaves correctly in every workspace without duplicating the resource. Which expression assigns instance_type appropriately?

Accepted Answer

instance_type = terraform.workspace == "dr" ? "t3.micro" : var.instance_type. The conditional operator compares the current workspace name to the target and chooses the hard-coded instance type only when they match, preserving the variable-driven value elsewhere. Both result branches are strings, so no type inconsistency arises and the single resource block adapts per workspace at plan time.

Answer

instance_type = terraform.workspace != "dr" ? "t3.micro" : var.instance_type

Answer

instance_type = terraform.workspace == "dr" ? var.instance_type : "t3.micro"

Answer

instance_type = var.instance_type == "dr" ? "t3.micro" : var.instance_type

Question 14

An engineer is authoring a reusable module that accepts variable "subnets", typed as map(object({ cidr_block = string, public = bool })). The module must create one aws_subnet per entry, attaching an aws_route_table_association only when that entry's public attribute is true. The association resource must not appear at all for private subnets, and its key must match the subnet's map key. Which approach satisfies these requirements with the least waste?

Accepted Answer

Iterate aws_subnet with for_each = var.subnets, and iterate aws_route_table_association with for_each = { for k, v in var.subnets : k => v if v.public }.. Filtering a map with a for expression that includes an if clause yields a new map containing only the entries that satisfy the predicate, and using that map with for_each gives each association the same stable key as its subnet. This avoids index drift, keeps resource addresses stable across changes, and naturally expresses the conditional existence of the association without count arithmetic.

Answer

Use count = length(var.subnets) on both aws_subnet and aws_route_table_association, and set the association's count to the number of entries where public is true.

Answer

Iterate aws_subnet with count over keys(var.subnets), and use element() lookups inside aws_route_table_association with a dynamic "public" block to skip private entries.

Answer

Iterate aws_subnet with for_each = var.subnets, then give aws_route_table_association a single instance whose subnet_id is a list built from all public entries via a for expression.

Question 15

You are writing a Terraform configuration that uses a `dynamic` block to generate multiple `ingress` blocks inside an `aws_security_group` resource. The `var.ingress_rules` variable is a list of objects with `from_port`, `to_port`, and `cidr_blocks`. You need to reference the current rule inside the dynamic block's content. Which iterator configuration and reference is correct?

Accepted Answer

dynamic "ingress" { for_each = var.ingress_rules iterator = rule content { from_port = rule.value.from_port } }. In a dynamic block, the iterator argument lets you name the temporary variable that represents the current element. The default is the block label, but explicitly setting iterator avoids ambiguity. Inside the content block, you access the current element via <iterator>.value. Using each.value is incorrect because each is only for resource-level for_each. Referencing key instead of value also fails to access the object's attributes.

Answer

dynamic "ingress" { for_each = var.ingress_rules iterator = ingress content { from_port = ingress.key.from_port } }

Answer

dynamic "ingress" { for_each = var.ingress_rules content { from_port = ingress.value.from_port } }

Answer

dynamic "ingress" { for_each = var.ingress_rules content { from_port = each.value.from_port } }