TF-004 Read, generate and modify configuration Practice Question
A developer has a module that outputs a list of subnet IDs. They want to use this list to create an EC2 instance in each subnet using for_each. Which for_each expression is correct?
⚠ Common exam trap
Many candidates assume `for_each` accepts lists directly, confusing it with `count`, or they overcomplicate the solution with a map expression when `toset()` is the simplest and most correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
toset(module.my_module.ids)
`for_each` in Terraform requires a map or a set of strings to iterate over, and `toset()` converts the list of subnet IDs into a set, which is a valid input for `for_each`. A plain list (as in option A) is not directly supported by `for_each`, which expects a map or set to ensure unique keys and deterministic behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
module.my_module.ids
Why it's wrong here
Directly passing `module.my_module.ids`, which is a list, to the `for_each` argument is incorrect because lists do not guarantee unique elements. Terraform's `for_each` mechanism relies on unique identifiers to manage resource instances effectively. A list, by its nature, can contain duplicate values, which would prevent Terraform from establishing stable, distinct addresses for each resource, leading to potential state conflicts or unpredictable behavior.
- ✓
toset(module.my_module.ids)
Why this is correct
The `toset()` function is the correct choice because Terraform's `for_each` argument specifically requires a set of strings or a map. When applied to a list, `toset()` converts it into a set, automatically deduplicating any identical elements. This ensures that each subnet ID from the module's output becomes a unique, stable key for `for_each`, allowing Terraform to reliably manage distinct resource instances.
- ✗
{ for id in module.my_module.ids : id => id }
Why it's wrong here
The expression { for id in module.my_module.ids : id => id } produces a map keyed by each subnet ID, but `for_each` requires unique keys. If the module’s list contains duplicate IDs—possible if the same subnet is output more than once—the map silently overwrites earlier keys, causing fewer EC2 instances than intended. This pattern tempts developers because it directly converts a list into a map of key-value pairs, a common technique when each item must also serve as its own key (e.g., for simple resource identifiers when duplicates are assured absent).
- ✗
module.my_module.ids[*]
Why it's wrong here
The splat expression `module.my_module.ids[*]` is used to extract or transform elements within a list, but its output is always another list. Terraform's `for_each` meta-argument strictly requires either a set of strings or a map to provide unique identifiers for resource instances. Consequently, attempting to use a list produced by a splat expression directly with `for_each` will result in a type constraint error, preventing successful configuration application.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.