{"id":7493,"date":"2026-10-13T08:30:05","date_gmt":"2026-10-13T08:30:05","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=7493"},"modified":"2026-10-13T08:31:35","modified_gmt":"2026-10-13T08:31:35","slug":"how-to-do-looping-iterations-in-terraform","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/how-to-do-looping-iterations-in-terraform\/","title":{"rendered":"Terraform Loops and Iteration: Complete Guide to count, for_each, for Expressions, and Dynamic Blocks"},"content":{"rendered":"\n

Terraform Loops and Iteration \u2014 Summary Table<\/h2>\n\n\n\n
#<\/th>Option \/ Method<\/th>Purpose<\/th>Input<\/th>Common use case<\/th>Creates resources?<\/th><\/tr>
1<\/td>count<\/code><\/td>Repeats a resource or module a specified number of times<\/td>Number<\/td>Create 3 EC2 instances or Azure VMs<\/td>Yes, when used on a resource\/module<\/td><\/tr>
2<\/td>for_each<\/code><\/td>Repeats resources or modules using named keys<\/td>Map or set of strings<\/td>Create VMs for dev<\/code>, test<\/code>, and prod<\/code><\/td>Yes, when used on a resource\/module<\/td><\/tr>
3<\/td>for<\/code> expression \u2014 list<\/td>Transforms elements into a new list<\/td>List, tuple, or set<\/td>Convert environment names to uppercase<\/td>No<\/td><\/tr>
4<\/td>for<\/code> expression \u2014 map<\/td>Transforms elements into a map\/object<\/td>Collection<\/td>Build a map of application names and settings<\/td>No<\/td><\/tr>
5<\/td>for<\/code> expression with if<\/code><\/td>Filters elements based on a condition<\/td>Collection<\/td>Select only enabled applications<\/td>No, but the result can drive resource creation<\/td><\/tr>
6<\/td>Nested for<\/code> expressions<\/td>Iterates over nested collections<\/td>Nested lists, maps, or objects<\/td>Generate application\/environment combinations<\/td>No, but the result can drive resource creation<\/td><\/tr>
7<\/td>dynamic<\/code> block<\/td>Generates repeated nested configuration blocks<\/td>Collection via for_each<\/code><\/td>Generate AWS security group ingress rules<\/td>No new top-level resources<\/td><\/tr>
8<\/td>flatten()<\/code> with iteration<\/td>Converts nested lists into a single list<\/td>Nested lists<\/td>Flatten application\/environment combinations<\/td>No<\/td><\/tr>
9<\/td>setproduct()<\/code> with iteration<\/td>Generates combinations from collections<\/td>Two or more collections<\/td>Create resources for every app\/environment combination<\/td>No, but the result can drive resource creation<\/td><\/tr>
10<\/td>toset()<\/code> with for_each<\/code><\/td>Converts a list to a set of unique strings<\/td>List<\/td>Create one resource per unique application name<\/td>Yes, through for_each<\/code><\/td><\/tr>
11<\/td>keys()<\/code> \/ values()<\/code><\/td>Extracts map keys or values<\/td>Map<\/td>Prepare data for iteration or outputs<\/td>No<\/td><\/tr>
12<\/td>Module count<\/code><\/td>Repeats module instances numerically<\/td>Number<\/td>Optionally deploy a module<\/td>Yes, creates module instances<\/td><\/tr>
13<\/td>Module for_each<\/code><\/td>Repeats module instances by key<\/td>Map or set of strings<\/td>Deploy a module for each application<\/td>Yes, creates module instances<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Complete Guide to count<\/code>, for_each<\/code>, for<\/code> Expressions, and Dynamic Blocks<\/h2>\n\n\n\n

Audience:<\/strong> Beginners through advanced DevOps \/ cloud engineers
Cloud examples:<\/strong> AWS EC2 and Azure Linux Virtual Machines
Terraform version:<\/strong> Terraform 1.3+ recommended
Approach:<\/strong> Each hands-on cloud lab is a standalone main.tf<\/code>, with run steps, expected outcomes, and cleanup.<\/p>\n\n\n\n

\n

Cost and security:<\/strong> Cloud labs create billable resources. Review plans before applying and destroy resources when finished. SSH rules should be limited to your own public IPv4 address using CIDR notation such as 203.0.113.10\/32<\/code>. Do not open SSH to 0.0.0.0\/0<\/code> in production. Never put cloud credentials or private keys in Terraform files.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

Contents<\/h2>\n\n\n\n
    \n
  1. Learning goals<\/li>\n\n\n\n
  2. Before you start<\/li>\n\n\n\n
  3. The five main iteration patterns<\/li>\n\n\n\n
  4. Lab 1 —\u00a0count<\/code>: create multiple instances<\/li>\n\n\n\n
  5. Lab 2 —\u00a0for_each<\/code>: create named instances<\/li>\n\n\n\n
  6. Lab 3 —\u00a0for<\/code>\u00a0expressions: transform collections<\/li>\n\n\n\n
  7. Lab 4 — Filtering with\u00a0for ... if<\/code><\/li>\n\n\n\n
  8. Lab 5 —\u00a0dynamic<\/code>\u00a0blocks<\/li>\n\n\n\n
  9. Lab 6 — Nested iteration and\u00a0flatten<\/code><\/li>\n\n\n\n
  10. Lab 7 —\u00a0setproduct<\/code>\u00a0for combinations<\/li>\n\n\n\n
  11. Lab 8 — Iterating over objects and maps<\/li>\n\n\n\n
  12. Lab 9 — Conditional iteration<\/li>\n\n\n\n
  13. Lab 10 — Iterating over modules<\/li>\n\n\n\n
  14. count<\/code>\u00a0vs\u00a0for_each<\/code><\/li>\n\n\n\n
  15. Common errors and troubleshooting<\/li>\n\n\n\n
  16. Best practices<\/li>\n\n\n\n
  17. Quick reference<\/li>\n\n\n\n
  18. Practice exercises<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    1. Learning goals<\/h2>\n\n\n\n

    After this guide, you should be able to:<\/p>\n\n\n\n

      \n
    • Repeat resources with\u00a0count<\/code>\u00a0or\u00a0for_each<\/code>.<\/li>\n\n\n\n
    • Transform a list, map, or object with a\u00a0for<\/code>\u00a0expression.<\/li>\n\n\n\n
    • Filter collections with an\u00a0if<\/code>\u00a0clause.<\/li>\n\n\n\n
    • Generate repeated nested blocks with\u00a0dynamic<\/code>.<\/li>\n\n\n\n
    • Flatten nested collections and generate combinations.<\/li>\n\n\n\n
    • Repeat modules with\u00a0count<\/code>\u00a0or\u00a0for_each<\/code>.<\/li>\n\n\n\n
    • Understand resource addresses, plan-time requirements, and common iteration errors.<\/li>\n\n\n\n
    • Run and clean up practical AWS and Azure labs.<\/li>\n<\/ul>\n\n\n\n

      2. Before you start<\/h2>\n\n\n\n

      Install Terraform and the relevant CLI.<\/p>\n\n\n\n

      AWS<\/h3>\n\n\n\n

      Configure credentials using an AWS profile, environment variables, or an IAM role. Confirm the identity:<\/p>\n\n\n

      terraform version\naws sts get<\/span>-caller-identity\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      You need permissions to create and delete EC2 instances and security groups. Use a valid Ubuntu AMI ID from the same AWS region as the provider.<\/p>\n\n\n\n
      Azure<\/h3>\n\n\n\n
      Sign in and select the right subscription:<\/p>\n\n\n
      terraform version\naz login\naz account show --output table\naz account set --subscription \"<SUBSCRIPTION_ID_OR_NAME<\/span>><\/span>\"\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
      You need permissions to create and delete resource groups, networking, public IPs, and Linux VMs. Regional quota, policy, and VM-size availability can prevent creation.<\/p>\n\n\n\n
      General workflow<\/h3>\n\n\n\n
      For each lab, use a separate empty directory and save that lab’s code as main.tf<\/code>.<\/p>\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan\nterraform apply\nterraform output\nterraform destroy\n<\/code><\/span><\/pre>\n\n\n
      Terraform prompts before applying or destroying unless you pass an automatic approval flag. For learning, review the plan and type the confirmation yourself.<\/p>\n\n\n\n
      Azure SSH key:<\/strong> Most Azure labs expect the contents of a public key, for example:<\/p>\n\n\n
      cat ~\/.ssh\/i<\/span>d_ed25519.pub\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      If no key exists, create one with ssh-keygen -t ed25519<\/code>. Pass the public<\/strong> key to Terraform, never the private key.<\/p>\n\n\n\n
      \n\n\n\n
      3. The five main iteration patterns<\/h2>\n\n\n\n
      \n\n\n\n
      Pattern Main purpose Typical use<\/p>\n\n\n\n
      \n\n\n\n
      count<\/code> Create a numeric number Three identical test of resource\/module instances, or one instances optional instance<\/p>\n\n\n\n
      for_each<\/code> Create instances from a One VM per named map or set of strings application<\/p>\n\n\n\n
      for<\/code> expression Transform a collection Convert names to into another collection uppercase or build a map<\/p>\n\n\n\n
      for ... if<\/code> Filter a collection Keep only enabled applications<\/p>\n\n\n\n
      dynamic<\/code> block Generate repeated AWS security-group nested blocks inside ingress rules one resource<\/h2>\n\n\n\n
      Supporting tools include flatten()<\/code>, toset()<\/code>, keys()<\/code>, values()<\/code>, zipmap()<\/code>, and setproduct()<\/code>. These are functions that help prepare collections for iteration.<\/p>\n\n\n\n
      \n\n\n\n
      4. Lab 1 — count<\/code>: create multiple instances<\/h2>\n\n\n\n
      How count<\/code> works<\/h3>\n\n\n\n
      count<\/code> accepts a non-negative integer. Terraform creates that many instances, and each instance has a numeric index:<\/p>\n\n\n\n
        \n
      • count.index<\/code>\u00a0starts at\u00a00<\/code>.<\/li>\n\n\n\n
      • With\u00a0count = 3<\/code>, the addresses are\u00a0resource.example[0]<\/code>,\u00a0[1]<\/code>, and\u00a0[2]<\/code>.<\/li>\n\n\n\n
      • resource.example[*].id<\/code>\u00a0collects IDs from all counted instances.<\/li>\n<\/ul>\n\n\n\n
        Use count<\/code> when instances are interchangeable or when a resource should exist only zero or one times. If removing an item from a list shifts indexes, Terraform can plan unexpected replacements.<\/p>\n\n\n\n
        4A. AWS — create three EC2 instances<\/h3>\n\n\n\n
        Save as main.tf<\/code>:<\/p>\n\n\n
        terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"instance_count\"<\/span> {\n  type    = number\n  default<\/span> = 3<\/span>\n\n  validation {\n    condition     = var<\/span>.instance_count >= 0<\/span> && var<\/span>.instance_count <= 5<\/span>\n    error_message = \"instance_count must be between 0 and 5 for this lab.\"<\/span>\n  }\n}\n\nvariable \"ami_id\"<\/span> {\n  type        = string\n  description = \"Valid Ubuntu AMI ID in the selected AWS region.\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type        = string\n  description = \"Your public IPv4 address in CIDR notation, e.g. 203.0.113.10\/32.\"<\/span>\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-count-lab-\"<\/span>\n  description = \"SSH restricted to the student's public IP\"<\/span>\n\n  ingress {\n    description = \"SSH from student IP only\"<\/span>\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n\n  tags = {\n    Name = \"tf-count-lab-sg\"<\/span>\n  }\n}\n\nresource \"aws_instance\"<\/span> \"web\"<\/span> {\n  count                  = var<\/span>.instance_count\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name  = \"count-web-${count.index + 1}\"<\/span>\n    Index = tostring(count.index)\n  }\n}\n\noutput \"instance_ids\"<\/span> {\n  value = aws_instance.web[*].id\n}\n\noutput \"instance_public_ips\"<\/span> {\n  value = aws_instance.web[*].public_ip\n}\n\noutput \"created_count\"<\/span> {\n  value = length(aws_instance.web)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Run:<\/p>\n\n\n
        terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        To test zero instances, use -var=\"instance_count=0\"<\/code> with plan<\/code> and then apply<\/code>. The security group remains because it is not counted. Destroy the lab when finished, using the same required variables.<\/p>\n\n\n\n
        Expected:<\/strong> The default creates three EC2 instances. Output lists their IDs and public IPs. AMI IDs are regional; get a current Ubuntu AMI for the configured region before applying.<\/p>\n\n\n\n
        4B. Azure — create three Linux VMs<\/h3>\n\n\n\n
        This example includes a resource group, VNet, subnet, public IPs, NSG, NICs, NSG association, and Linux VMs.<\/p>\n\n\n
        terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"vm_count\"<\/span> {\n  type    = number\n  default<\/span> = 3<\/span>\n\n  validation {\n    condition     = var<\/span>.vm_count >= 0<\/span> && var<\/span>.vm_count <= 5<\/span>\n    error_message = \"vm_count must be between 0 and 5 for this lab.\"<\/span>\n  }\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type        = string\n  description = \"Contents of your SSH public key.\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type        = string\n  description = \"Your public IPv4 address in CIDR notation, e.g. 203.0.113.10\/32.\"<\/span>\n}\n\nlocals {\n  prefix = \"tfcount\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.100.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.100.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"vm\"<\/span> {\n  count               = var<\/span>.vm_count\n  name                = \"${local.prefix}-pip-${count.index + 1}\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"vm\"<\/span> {\n  count               = var<\/span>.vm_count\n  name                = \"${local.prefix}-nic-${count.index + 1}\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.vm[count.index].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"vm\"<\/span> {\n  count                     = var<\/span>.vm_count\n  network_interface_id      = azurerm_network_interface.vm[count.index].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"vm\"<\/span> {\n  count               = var<\/span>.vm_count\n  name                = \"${local.prefix}-vm-${count.index + 1}\"<\/span>\n  computer_name       = \"${local.prefix}-${count.index + 1}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.vm[count.index].id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Lab   = \"count\"<\/span>\n    Index = tostring(count.index)\n  }\n}\n\noutput \"vm_ids\"<\/span> {\n  value = azurerm_linux_virtual_machine.vm[*].id\n}\n\noutput \"public_ips\"<\/span> {\n  value = azurerm_public_ip.vm[*].ip_address\n}\n\noutput \"created_count\"<\/span> {\n  value = length(azurerm_linux_virtual_machine.vm)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Run:<\/p>\n\n\n
        terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Try -var=\"vm_count=0\"<\/code> to see the VMs, NICs, and public IPs removed while the shared network remains. Use terraform destroy<\/code> when finished. Verify VM size availability and quota for your subscription and region.<\/p>\n\n\n\n
        \n\n\n\n
        5. Lab 2 — for_each<\/code>: create named instances<\/h2>\n\n\n\n
        How for_each<\/code> works<\/h3>\n\n\n\n
        for_each<\/code> accepts a map or a set of strings. Terraform creates one instance for every key:<\/p>\n\n\n\n
          \n
        • Map:\u00a0each.key<\/code>\u00a0is the map key;\u00a0each.value<\/code>\u00a0is the associated value.<\/li>\n\n\n\n
        • Set of strings:\u00a0each.key<\/code>\u00a0and\u00a0each.value<\/code>\u00a0are the current string.<\/li>\n\n\n\n
        • Addresses use stable keys, for example\u00a0aws_instance.app[\"frontend\"]<\/code>.<\/li>\n<\/ul>\n\n\n\n
          This is usually the better choice when each resource has a meaningful identity, such as an application, environment, or subnet.<\/p>\n\n\n\n
          5A. AWS — create one EC2 instance per application<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    instance_type = string\n    environment   = string\n  }))\n  default<\/span> = {\n    frontend = { instance_type = \"t3.micro\"<\/span>, environment = \"dev\"<\/span> }\n    backend  = { instance_type = \"t3.micro\"<\/span>, environment = \"test\"<\/span> }\n    worker   = { instance_type = \"t3.micro\"<\/span>, environment = \"dev\"<\/span> }\n  }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-foreach-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"app\"<\/span> {\n  for_each               = var<\/span>.applications\n  ami                    = var<\/span>.ami_id\n  instance_type          = each.value.instance_type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = \"app-${each.key}\"<\/span>\n    Application = each.key\n    Environment = each.value.environment\n  }\n}\n\noutput \"instance_ids_by_application\"<\/span> {\n  value = { for<\/span> name, instance in<\/span> aws_instance.app : name<\/span> =><\/span> instance.id }\n}\n\noutput \"public_ips_by_application\"<\/span> {\n  value = { for<\/span> name, instance in<\/span> aws_instance.app : name<\/span> =><\/span> instance.public_ip }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run:<\/p>\n\n\n
          terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform destroy \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expected:<\/strong> Three EC2 instances with keys frontend<\/code>, backend<\/code>, and worker<\/code>. The output maps application names to IDs and IPs.<\/p>\n\n\n\n
          5B. Azure — create one Linux VM per application<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    vm_size     = string\n    environment = string\n  }))\n  default<\/span> = {\n    frontend = { vm_size = \"Standard_B1s\"<\/span>, environment = \"dev\"<\/span> }\n    backend  = { vm_size = \"Standard_B1s\"<\/span>, environment = \"test\"<\/span> }\n    worker   = { vm_size = \"Standard_B1s\"<\/span>, environment = \"dev\"<\/span> }\n  }\n}\n\nlocals {\n  prefix = \"tfforeach\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.110.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.110.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"app\"<\/span> {\n  for_each            = var<\/span>.applications\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"app\"<\/span> {\n  for_each            = var<\/span>.applications\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.app[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"app\"<\/span> {\n  for_each                  = var<\/span>.applications\n  network_interface_id      = azurerm_network_interface.app[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"app\"<\/span> {\n  for_each            = var<\/span>.applications\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = each.value.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.app[each.key].id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application = each.key\n    Environment = each.value.environment\n  }\n}\n\noutput \"vm_ids_by_application\"<\/span> {\n  value = { for<\/span> name, vm in<\/span> azurerm_linux_virtual_machine.app : name<\/span> =><\/span> vm.id }\n}\n\noutput \"public_ips_by_application\"<\/span> {\n  value = { for<\/span> name, pip in<\/span> azurerm_public_ip.app : name<\/span> =><\/span> pip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run:<\/p>\n\n\n
          terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform destroy \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expected:<\/strong> Three VMs, each with its own public IP, NIC, and stable key. Azure resource names have restrictions; keep names short and use supported characters.<\/p>\n\n\n\n
          \n\n\n\n
          6. Lab 3 — for<\/code> expressions: transform collections<\/h2>\n\n\n\n
          How for<\/code> expressions work<\/h3>\n\n\n\n
          A for<\/code> expression reads items from a collection and builds a new list\/tuple or map\/object.<\/p>\n\n\n\n
          List result:<\/p>\n\n\n
          [for name in var.names : upper(name)]\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
          Map result:<\/p>\n\n\n
          { for<\/span> name in<\/span> var<\/span>.names : name<\/span> =><\/span> upper(name) }\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          The for<\/code> expression itself does not create cloud resources. It creates data that can be used by resources, outputs, or locals.<\/p>\n\n\n\n
          6A. AWS — build a map of instance metadata<\/h3>\n\n\n\n
          This is a complete EC2 example that uses a for<\/code> expression to prepare names and output the resources as a map.<\/p>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"names\"<\/span> {\n  type    = list(string)\n  default<\/span> = [\"frontend\"<\/span>, \"backend\"<\/span>, \"worker\"<\/span>]\n}\n\nlocals {\n  normalized_names = [for<\/span> name in<\/span> var<\/span>.names : lower(trimspace(name))]\n  name_to_tag      = { for<\/span> name in<\/span> local.normalized_names : name<\/span> =><\/span> upper(name) }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-for-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"app\"<\/span> {\n  for_each               = toset(local.normalized_names)\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name          = \"for-${each.key}\"<\/span>\n    NormalizedTag = local.name_to_tag[each.key]\n  }\n}\n\noutput \"normalized_names\"<\/span> {\n  value = local.normalized_names\n}\n\noutput \"uppercase_map\"<\/span> {\n  value = local.name_to_tag\n}\n\noutput \"instance_ids\"<\/span> {\n  value = { for<\/span> name, instance in<\/span> aws_instance.app : name<\/span> =><\/span> instance.id }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the standard AWS workflow and supply ami_id<\/code> and ssh_cidr<\/code>. Change the names<\/code> list to experiment. Since this lab uses a set for for_each<\/code>, duplicate names collapse to one key. Keep names unique to avoid confusing results.<\/p>\n\n\n\n
          6B. Azure — transform names and create VMs from the resulting collection<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"names\"<\/span> {\n  type    = list(string)\n  default<\/span> = [\"frontend\"<\/span>, \"backend\"<\/span>, \"worker\"<\/span>]\n}\n\nlocals {\n  normalized_names = [for<\/span> name in<\/span> var<\/span>.names : lower(trimspace(name))]\n  name_to_tag      = { for<\/span> name in<\/span> local.normalized_names : name<\/span> =><\/span> upper(name) }\n  prefix           = \"tffor\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.120.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.120.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"app\"<\/span> {\n  for_each            = toset(local.normalized_names)\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"app\"<\/span> {\n  for_each            = toset(local.normalized_names)\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.app[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"app\"<\/span> {\n  for_each                  = toset(local.normalized_names)\n  network_interface_id      = azurerm_network_interface.app[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"app\"<\/span> {\n  for_each            = toset(local.normalized_names)\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.app[each.key].id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application   = each.key\n    NormalizedTag = local.name_to_tag[each.key]\n  }\n}\n\noutput \"normalized_names\"<\/span> {\n  value = local.normalized_names\n}\n\noutput \"uppercase_map\"<\/span> {\n  value = local.name_to_tag\n}\n\noutput \"public_ips\"<\/span> {\n  value = { for<\/span> name, pip in<\/span> azurerm_public_ip.app : name<\/span> =><\/span> pip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the standard Azure workflow and SSH inputs. The for<\/code> expressions prepare the normalized list and map; for_each<\/code> then creates one VM per unique normalized name.<\/p>\n\n\n\n
          \n\n\n\n
          7. Lab 4 — Filtering with for ... if<\/code><\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          The if<\/code> at the end of a for<\/code> expression filters elements. Only items for which the condition is true appear in the resulting collection.<\/p>\n\n\n\n
          Example:<\/p>\n\n\n
          locals {\n  enabled_apps = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          7A. AWS — create instances only for enabled applications<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    enabled      = bool\n    instance_type = string\n  }))\n  default<\/span> = {\n    frontend = { enabled = true<\/span>,  instance_type = \"t3.micro\"<\/span> }\n    backend  = { enabled = true<\/span>,  instance_type = \"t3.micro\"<\/span> }\n    sandbox  = { enabled = false<\/span>, instance_type = \"t3.micro\"<\/span> }\n  }\n}\n\nlocals {\n  enabled_apps = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-filter-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"app\"<\/span> {\n  for_each               = local.enabled_apps\n  ami                    = var<\/span>.ami_id\n  instance_type          = each.value.instance_type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = \"filter-${each.key}\"<\/span>\n    Application = each.key\n  }\n}\n\noutput \"enabled_app_names\"<\/span> {\n  value = keys(local.enabled_apps)\n}\n\noutput \"instance_ids\"<\/span> {\n  value = { for<\/span> name, instance in<\/span> aws_instance.app : name<\/span> =><\/span> instance.id }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the standard AWS workflow. The default creates frontend<\/code> and backend<\/code>; sandbox<\/code> is filtered out. To enable it, change enabled = false<\/code> to true<\/code> in the variable default or provide a complete replacement map in a terraform.tfvars<\/code> file.<\/p>\n\n\n\n
          7B. Azure — create VMs only for enabled applications<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    enabled = bool\n    vm_size = string\n  }))\n  default<\/span> = {\n    frontend = { enabled = true<\/span>,  vm_size = \"Standard_B1s\"<\/span> }\n    backend  = { enabled = true<\/span>,  vm_size = \"Standard_B1s\"<\/span> }\n    sandbox  = { enabled = false<\/span>, vm_size = \"Standard_B1s\"<\/span> }\n  }\n}\n\nlocals {\n  prefix = \"tffilter\"<\/span>\n  enabled_apps = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.130.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.130.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_apps\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_apps\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.app[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"app\"<\/span> {\n  for_each                  = local.enabled_apps\n  network_interface_id      = azurerm_network_interface.app[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_apps\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = each.value.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.app[each.key].id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application = each.key\n  }\n}\n\noutput \"enabled_app_names\"<\/span> {\n  value = keys(local.enabled_apps)\n}\n\noutput \"public_ips\"<\/span> {\n  value = { for<\/span> name, pip in<\/span> azurerm_public_ip.app : name<\/span> =><\/span> pip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the Azure workflow and SSH inputs. By default, only frontend<\/code> and backend<\/code> are created. Enabling sandbox<\/code> creates its public IP, NIC, and VM.<\/p>\n\n\n\n
          \n\n\n\n
          8. Lab 5 — dynamic<\/code> blocks<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          A dynamic<\/code> block generates nested blocks within a resource. It is not the same as for_each<\/code> on a resource: – for_each<\/code> on a resource creates multiple top-level resources. – dynamic<\/code> creates multiple nested blocks inside one resource.<\/p>\n\n\n\n
          8A. AWS — dynamic security group ingress rules<\/h3>\n\n\n\n
          This example creates one security group and generates one ingress block per rule. SSH is restricted to your CIDR. HTTP is an example rule restricted to a private network range.<\/p>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"enable_http_rule\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nlocals {\n  fixed_rules = [\n    {\n      name = \"ssh\"<\/span>\n      port = 22<\/span>\n      cidr = var<\/span>.ssh_cidr\n    }\n  ]\n\n  optional_rules = var<\/span>.enable_http_rule ? [\n    {\n      name = \"http-private\"<\/span>\n      port = 80<\/span>\n      cidr = \"10.0.0.0\/8\"<\/span>\n    }\n  ] : []\n\n  ingress_rules = concat(local.fixed_rules, local.optional_rules)\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-dynamic-lab-\"<\/span>\n  description = \"Dynamic ingress rule demonstration\"<\/span>\n\n  dynamic \"ingress\"<\/span> {\n    for_each = local.ingress_rules\n    iterator = rule\n\n    content {\n      description = rule.value.name\n      from_port   = rule.value.port\n      to_port     = rule.value.port\n      protocol    = \"tcp\"<\/span>\n      cidr_blocks = [rule.value.cidr]\n    }\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n\n  tags = {\n    Name = \"tf-dynamic-lab-sg\"<\/span>\n  }\n}\n\noutput \"configured_rules\"<\/span> {\n  value = local.ingress_rules\n}\n\noutput \"security_group_id\"<\/span> {\n  value = aws_security_group.lab.id\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run:<\/p>\n\n\n
          terraform init\nterraform fmt\nterraform validate\nterraform plan -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform plan -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span> -var<\/span>=\"enable_http_rule=false\"<\/span>\nterraform destroy -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          This lab creates a security group only, so it does not create an EC2 instance. The HTTP rule is limited to 10.0.0.0\/8<\/code> as an example and will not necessarily be reachable from your laptop.<\/p>\n\n\n\n
          8B. Azure — iterate NSG rules with for_each<\/code><\/h3>\n\n\n\n
          Azure NSG rules are normally represented as separate azurerm_network_security_rule<\/code> resources, so use for_each<\/code> instead of a dynamic<\/code> block for this provider pattern.<\/p>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"enable_http_rule\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nlocals {\n  rules = merge(\n    {\n      ssh = {\n        priority = 100<\/span>\n        port     = \"22\"<\/span>\n        source   = var<\/span>.ssh_cidr\n      }\n    },\n    var<\/span>.enable_http_rule ? {\n      http = {\n        priority = 110<\/span>\n        port     = \"80\"<\/span>\n        source   = \"10.0.0.0\/8\"<\/span>\n      }\n    } : {}\n  )\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"tfdynamic-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"tfdynamic-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_network_security_rule\"<\/span> \"rule\"<\/span> {\n  for_each                    = local.rules\n  name                        = \"Allow-${each.key}\"<\/span>\n  priority                    = each.value.priority\n  direction                   = \"Inbound\"<\/span>\n  access                      = \"Allow\"<\/span>\n  protocol                    = \"Tcp\"<\/span>\n  source_port_range           = \"*\"<\/span>\n  destination_port_range      = each.value.port\n  source_address_prefix       = each.value.source\n  destination_address_prefix  = \"*\"<\/span>\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\noutput \"created_rule_names\"<\/span> {\n  value = keys(azurerm_network_security_rule.rule)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run terraform init<\/code>, terraform validate<\/code>, and terraform plan -var=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/code>. Set -var=\"enable_http_rule=false\"<\/code> to omit the HTTP rule. Destroy the lab when finished. This lab focuses on iteration and NSG rules; the next labs demonstrate complete VM networking.<\/p>\n\n\n\n
          \n\n\n\n
          9. Lab 6 — Nested iteration and flatten<\/code><\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          When input data is nested, a for<\/code> expression can create a nested list and flatten()<\/code> can turn it into one list. The flattened list can then be converted to a map for for_each<\/code>.<\/p>\n\n\n\n
          Example input:<\/p>\n\n\n
          variable \"applications\"<\/span> {\n  default<\/span> = {\n    frontend = [\"dev\"<\/span>, \"test\"<\/span>]\n    backend  = [\"dev\"<\/span>, \"prod\"<\/span>]\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Desired combinations: frontend-dev<\/code>, frontend-test<\/code>, backend-dev<\/code>, backend-prod<\/code>.<\/p>\n\n\n\n
          9A. AWS — one EC2 instance for each application\/environment pair<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(list<\/span>(string))\n  default<\/span> = {\n    frontend = [\"dev\"<\/span>, \"test\"<\/span>]\n    backend  = [\"dev\"<\/span>, \"prod\"<\/span>]\n  }\n}\n\nlocals {\n  pairs_nested = [\n    for<\/span> app_name, environments in var<\/span>.applications : [\n      for<\/span> environment in environments : {\n        key         = \"${app_name}-${environment}\"<\/span>\n        app         = app_name\n        environment = environment\n      }\n    ]\n  ]\n\n  pairs = flatten(local.pairs_nested)\n  instances = {\n    for<\/span> item in local.pairs : item.key => item\n  }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-flatten-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"pair\"<\/span> {\n  for_each               = local.instances\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = each.key\n    Application = each.value.app\n    Environment = each.value.environment\n  }\n}\n\noutput \"instance_keys\"<\/span> {\n  value = keys(aws_instance.pair)\n}\n\noutput \"instance_ids\"<\/span> {\n  value = { for<\/span> key, instance in aws_instance.pair : key => instance.id }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the usual AWS commands and inputs. Expect four instances. The instances<\/code> map provides stable, descriptive keys.<\/p>\n\n\n\n
          9B. Azure — one Linux VM for each application\/environment pair<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(list<\/span>(string))\n  default<\/span> = {\n    frontend = [\"dev\"<\/span>, \"test\"<\/span>]\n    backend  = [\"dev\"<\/span>, \"prod\"<\/span>]\n  }\n}\n\nlocals {\n  prefix = \"tfflatten\"<\/span>\n  pairs_nested = [\n    for<\/span> app_name, environments in var<\/span>.applications : [\n      for<\/span> environment in environments : {\n        key         = \"${app_name}-${environment}\"<\/span>\n        app         = app_name\n        environment = environment\n      }\n    ]\n  ]\n  pairs = flatten(local.pairs_nested)\n  instances = {\n    for<\/span> item in local.pairs : item.key => item\n  }\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.140.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.140.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.pair[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"pair\"<\/span> {\n  for_each                  = local.instances\n  network_interface_id      = azurerm_network_interface.pair[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.pair[each.key].id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application = each.value.app\n    Environment = each.value.environment\n  }\n}\n\noutput \"instance_keys\"<\/span> {\n  value = keys(azurerm_linux_virtual_machine.pair)\n}\n\noutput \"public_ips\"<\/span> {\n  value = { for<\/span> key, pip in azurerm_public_ip.pair : key => pip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the Azure workflow and SSH inputs. Expect four VMs. If you change the nested lists, inspect the plan carefully: removed keys cause the corresponding VMs and network resources to be destroyed.<\/p>\n\n\n\n
          \n\n\n\n
          10. Lab 7 — setproduct<\/code> for combinations<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          setproduct()<\/code> returns combinations from two or more collections. It is useful for combinations such as each application across each environment. Only use it when all combinations are truly desired.<\/p>\n\n\n\n
          7A. AWS — create EC2 instances across app and environment combinations<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type    = set(string)\n  default<\/span> = [\"frontend\"<\/span>, \"backend\"<\/span>]\n}\n\nvariable \"environments\"<\/span> {\n  type    = set(string)\n  default<\/span> = [\"dev\"<\/span>, \"test\"<\/span>]\n}\n\nlocals {\n  combinations = [\n    for<\/span> pair in setproduct(var<\/span>.applications, var<\/span>.environments) : {\n      app         = pair[0<\/span>]\n      environment = pair[1<\/span>]\n      key         = \"${pair[0]}-${pair[1]}\"<\/span>\n    }\n  ]\n\n  instances = { for<\/span> item in local.combinations : item.key => item }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-product-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"pair\"<\/span> {\n  for_each               = local.instances\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = each.key\n    Application = each.value.app\n    Environment = each.value.environment\n  }\n}\n\noutput \"combination_keys\"<\/span> {\n  value = keys(aws_instance.pair)\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with AWS inputs. The defaults create four EC2 instances: frontend-dev, frontend-test, backend-dev, and backend-test.<\/p>\n\n\n\n
          7B. Azure — create Linux VMs across app and environment combinations<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type    = set(string)\n  default<\/span> = [\"frontend\"<\/span>, \"backend\"<\/span>]\n}\n\nvariable \"environments\"<\/span> {\n  type    = set(string)\n  default<\/span> = [\"dev\"<\/span>, \"test\"<\/span>]\n}\n\nlocals {\n  prefix = \"tfproduct\"<\/span>\n  combinations = [\n    for<\/span> pair in setproduct(var<\/span>.applications, var<\/span>.environments) : {\n      app         = pair[0<\/span>]\n      environment = pair[1<\/span>]\n      key         = \"${pair[0]}-${pair[1]}\"<\/span>\n    }\n  ]\n  instances = { for<\/span> item in local.combinations : item.key => item }\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.150.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.150.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.pair[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"pair\"<\/span> {\n  for_each                  = local.instances\n  network_interface_id      = azurerm_network_interface.pair[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"pair\"<\/span> {\n  for_each            = local.instances\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.pair[each.key].id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application = each.value.app\n    Environment = each.value.environment\n  }\n}\n\noutput \"combination_keys\"<\/span> {\n  value = keys(azurerm_linux_virtual_machine.pair)\n}\n\noutput \"public_ips\"<\/span> {\n  value = { for<\/span> key, pip in azurerm_public_ip.pair : key => pip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with Azure inputs. Expect four VMs. Before scaling this pattern up, calculate the number of combinations: the total is the product of the collection sizes.<\/p>\n\n\n\n
          \n\n\n\n
          11. Lab 8 — Iterating over objects and maps<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          A map of objects lets each resource have its own settings. For example, each VM may have a name, size, and environment tag. each.value<\/code> accesses that object’s attributes.<\/p>\n\n\n\n
          8A. AWS — per-instance configuration<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"servers\"<\/span> {\n  type = map(object({\n    instance_type = string\n    owner         = string\n    environment   = string\n  }))\n  default<\/span> = {\n    api = {\n      instance_type = \"t3.micro\"<\/span>\n      owner         = \"platform\"<\/span>\n      environment   = \"dev\"<\/span>\n    }\n    batch = {\n      instance_type = \"t3.micro\"<\/span>\n      owner         = \"data\"<\/span>\n      environment   = \"test\"<\/span>\n    }\n  }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"tf-object-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"server\"<\/span> {\n  for_each               = var<\/span>.servers\n  ami                    = var<\/span>.ami_id\n  instance_type          = each.value.instance_type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = each.key\n    Owner       = each.value.owner\n    Environment = each.value.environment\n  }\n}\n\noutput \"server_configuration\"<\/span> {\n  value = {\n    for<\/span> name, instance in<\/span> aws_instance.server :\n    name<\/span> =><\/span> {\n      id        = instance.id\n      public_ip = instance.public_ip\n    }\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with AWS inputs. Inspect the tags in the EC2 console and terraform output<\/code>.<\/p>\n\n\n\n
          8B. Azure — per-VM configuration<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"servers\"<\/span> {\n  type = map(object({\n    vm_size     = string\n    owner       = string\n    environment = string\n  }))\n  default<\/span> = {\n    api = {\n      vm_size     = \"Standard_B1s\"<\/span>\n      owner       = \"platform\"<\/span>\n      environment = \"dev\"<\/span>\n    }\n    batch = {\n      vm_size     = \"Standard_B1s\"<\/span>\n      owner       = \"data\"<\/span>\n      environment = \"test\"<\/span>\n    }\n  }\n}\n\nlocals {\n  prefix = \"tfobject\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.160.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.160.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  security_rule {\n    name                       = \"AllowSSHFromStudent\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"server\"<\/span> {\n  for_each            = var<\/span>.servers\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"server\"<\/span> {\n  for_each            = var<\/span>.servers\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.server[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"server\"<\/span> {\n  for_each                  = var<\/span>.servers\n  network_interface_id      = azurerm_network_interface.server[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"server\"<\/span> {\n  for_each            = var<\/span>.servers\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  computer_name       = \"${local.prefix}-${each.key}\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = each.value.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.server[each.key].id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Owner       = each.value.owner\n    Environment = each.value.environment\n  }\n}\n\noutput \"server_configuration\"<\/span> {\n  value = {\n    for<\/span> name, vm in<\/span> azurerm_linux_virtual_machine.server :\n    name<\/span> =><\/span> {\n      id        = vm.id\n      public_ip = azurerm_public_ip.server[name].ip_address\n    }\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with Azure SSH inputs. Each object drives the size and tags for the corresponding VM.<\/p>\n\n\n\n
          \n\n\n\n
          12. Lab 9 — Conditional iteration<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          Iteration and conditional logic can be combined. For example, use a map of services and include only those with enabled = true<\/code>. This is useful for optional environments, apps, and infrastructure components.<\/p>\n\n\n\n
          9A. AWS — enabled instances and per-app types<\/h3>\n\n\n\n
          Use the AWS filtering example from Lab 4 as the complete lab. Its key logic is:<\/p>\n\n\n
          locals {\n  enabled_apps = {\n    for<\/span> name, app in var<\/span>.applications : name => app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"aws_instance\"<\/span> \"app\"<\/span> {\n  for_each      = local.enabled_apps\n  ami           = var<\/span>.ami_id\n  instance_type = each.value.instance_type\n  # Include the security group and tags from Lab 4.<\/span>\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          The full standalone AWS configuration is in Lab 4A<\/strong>. Copy that entire example into its own directory to run it.<\/p>\n\n\n\n
          9B. Azure — enabled VMs and related network resources<\/h3>\n\n\n\n
          Use the Azure filtering example from Lab 4 as the complete lab. Its key logic is:<\/p>\n\n\n
          locals {\n  enabled_apps = {\n    for<\/span> name, app in var<\/span>.applications : name => app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"app\"<\/span> {\n  for_each = local.enabled_apps\n  # The full VM, NIC, public IP, and NSG configuration is in Lab 4B.<\/span>\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          The full standalone Azure configuration is in Lab 4B<\/strong>. Copy that entire example into its own directory. The public IPs, NICs, associations, and VMs all use the same filtered map, so their keys stay aligned.<\/p>\n\n\n\n
          \n\n\n\n
          13. Lab 10 — Iterating over modules<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          Terraform modules can use count<\/code> or for_each<\/code>, just like resources. This lab uses a local module so you can experiment without cloud costs. The same pattern can be applied to a module that provisions EC2 or Azure VMs.<\/p>\n\n\n\n
          Create this directory structure:<\/p>\n\n\n
          module<\/span>-iteration-lab\/\n\u251c\u2500\u2500 main.tf\n\u2514\u2500\u2500 modules\/\n    \u2514\u2500\u2500 label\/\n        \u2514\u2500\u2500 main.tf\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Root main.tf<\/code>:<\/p>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n}\n\nvariable \"labels\"<\/span> {\n  type    = set(string)\n  default<\/span> = [\"frontend\"<\/span>, \"backend\"<\/span>, \"worker\"<\/span>]\n}\n\nmodule \"label\"<\/span> {\n  source   = \".\/modules\/label\"<\/span>\n  for_each = var<\/span>.labels\n\n  label = each.key\n}\n\noutput \"uppercase_labels\"<\/span> {\n  value = { for<\/span> name, module_instance in module.label : name => module_instance.value }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          modules\/label\/main.tf<\/code>:<\/p>\n\n\n
          variable \"label\"<\/span> {\n  type = string\n}\n\noutput \"value\"<\/span> {\n  value = upper(var<\/span>.label)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run:<\/p>\n\n\n
          terraform init\nterraform fmt\nterraform validate\nterraform plan\nterraform apply\nterraform output\nterraform destroy\n<\/code><\/span><\/pre>\n\n\n
          Expected output is a map like:<\/p>\n\n\n
          {\n  \"backend\"<\/span>  = \"BACKEND\"<\/span>\n  \"frontend\"<\/span> = \"FRONTEND\"<\/span>\n  \"worker\"<\/span>   = \"WORKER\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          No cloud resources are created in this lab.<\/p>\n\n\n\n
          \n\n\n\n
          14. count<\/code> vs for_each<\/code><\/h2>\n\n\n\n
          \n\n\n\n
          Question count<\/code> for_each<\/code><\/p>\n\n\n\n
          \n\n\n\n
          Input type Integer Map or set of strings<\/p>\n\n\n\n
          Resource address [0]<\/code>, [1]<\/code>, etc. [\"key\"]<\/code><\/p>\n\n\n\n
          Best use Numeric quantity or Named, independently on\/off managed resources<\/p>\n\n\n\n
          Stable identity Index-based Key-based<\/p>\n\n\n\n
          Typical risk Index changes can shift Changing a key changes identities the address<\/h2>\n\n\n\n
          Example addresses<\/h3>\n\n\n
          # count<\/span>\naws_instance<\/span>.web<\/span>[0]<\/span>\n\n# for_each<\/span>\naws_instance<\/span>.app<\/span>[\"frontend\"<\/span>]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          Prefer for_each<\/code> when resources have meaningful names or different configuration. Prefer count<\/code> for a simple number of interchangeable resources or a basic conditional resource.<\/p>\n\n\n\n
          \n\n\n\n
          15. Common errors and troubleshooting<\/h2>\n\n\n\n
          Invalid for_each<\/code> argument<\/h3>\n\n\n\n
          Cause:<\/strong> The value is not a map or set of strings, or Terraform cannot know the keys during planning.<\/p>\n\n\n\n
          Fix:<\/strong> Use a map\/set and keys known before apply. A common pattern is to use known application names as keys and put computed IDs in values.<\/p>\n\n\n\n
          Invalid count<\/code> argument<\/h3>\n\n\n\n
          Cause:<\/strong> Terraform cannot determine the number of instances during planning.<\/p>\n\n\n\n
          Fix:<\/strong> Base count<\/code> on known variables or configuration. Avoid using a resource attribute that is unknown until apply.<\/p>\n\n\n\n
          Invalid index when count is zero<\/h3>\n\n\n\n
          Cause:<\/strong> Code references resource.example[0]<\/code> even though count = 0<\/code>.<\/p>\n\n\n\n
          Fix:<\/strong> Guard the reference with a conditional expression or use a splat expression such as resource.example[*].id<\/code>.<\/p>\n\n\n\n
          Duplicate keys in a for<\/code> expression<\/h3>\n\n\n\n
          Cause:<\/strong> A map comprehension produces the same key more than once.<\/p>\n\n\n\n
          Fix:<\/strong> Make keys unique or use grouping mode (...<\/code>) if grouping values under each key is intended.<\/p>\n\n\n\n
          Unexpected replacement when changing count<\/h3>\n\n\n\n
          Cause:<\/strong> Counted resources are indexed numerically. Removing or reordering list elements can change which object belongs to an index.<\/p>\n\n\n\n
          Fix:<\/strong> Use for_each<\/code> with stable names for independently meaningful resources.<\/p>\n\n\n\n
          Azure VM size or quota error<\/h3>\n\n\n\n
          Cause:<\/strong> The size is not available in the region, restricted by policy, or exceeds subscription quota.<\/p>\n\n\n\n
          Fix:<\/strong> Verify regional availability, subscription quota, and policy. Terraform iteration cannot increase quota.<\/p>\n\n\n\n
          AWS AMI not found<\/h3>\n\n\n\n
          Cause:<\/strong> AMI IDs are regional or stale.<\/p>\n\n\n\n
          Fix:<\/strong> Find a current Ubuntu AMI in the provider’s configured region.<\/p>\n\n\n\n
          SSH does not work<\/h3>\n\n\n\n
          Check the source CIDR, public IP, routing, NSG\/security group, and private key. Supply the SSH public<\/strong> key to Azure. Do not expose SSH globally to solve a connectivity issue.<\/p>\n\n\n\n
          \n\n\n\n
          16. Best practices<\/h2>\n\n\n\n
            \n
          1. Use\u00a0for_each<\/code>\u00a0for named infrastructure that should retain stable identities.<\/li>\n\n\n\n
          2. Use\u00a0count<\/code>\u00a0for simple quantities and on\/off resources.<\/li>\n\n\n\n
          3. Keep\u00a0for<\/code>\u00a0expressions readable; use intermediate\u00a0locals<\/code>\u00a0for complex transformations.<\/li>\n\n\n\n
          4. Filter a collection before passing it to\u00a0for_each<\/code>.<\/li>\n\n\n\n
          5. Use the same key map for related resources such as public IPs, NICs, and VMs.<\/li>\n\n\n\n
          6. Use\u00a0dynamic<\/code>\u00a0only for nested blocks; it is not a replacement for resource\u00a0for_each<\/code>.<\/li>\n\n\n\n
          7. Check the plan after changing keys or counts because instances may be destroyed or replaced.<\/li>\n\n\n\n
          8. Keep resource names unique and within cloud-provider naming restrictions.<\/li>\n\n\n\n
          9. Pin provider major versions and review upgrades.<\/li>\n\n\n\n
          10. Use least-privilege networking and keep secrets out of Terraform files.<\/li>\n\n\n\n
          11. Keep each lab in its own directory or isolated state.<\/li>\n\n\n\n
          12. Destroy lab infrastructure when finished.<\/li>\n<\/ol>\n\n\n\n
            \n\n\n\n
            17. Quick reference<\/h2>\n\n\n\n
            Task Syntax<\/p>\n\n\n\n
            \n\n\n\n
            Repeat a resource N times count = var.n<\/code> Access count index count.index<\/code> Collect count outputs resource.example[*].id<\/code> Repeat for each map\/set item for_each = var.items<\/code> Access current key\/value each.key<\/code>, each.value<\/code> Transform a list [for x in var.items : expression]<\/code> Build a map { for x in var.items : x.key => x.value }<\/code> Filter a collection [for x in var.items : x if condition]<\/code> Filter a map { for k, v in var.map : k => v if condition }<\/code> Flatten nested lists flatten(local.nested)<\/code> Convert list to set toset(var.list)<\/code> Extract map keys keys(var.map)<\/code> Extract map values values(var.map)<\/code> Generate combinations setproduct(var.a, var.b)<\/code> Generate nested blocks dynamic \"block_name\" { for_each = ... }<\/code> Repeat module instances module \"x\" { for_each = ... }<\/code><\/p>\n\n\n\n
            \n\n\n\n
            18. Practice exercises<\/h2>\n\n\n\n
            Exercise 1 — Count<\/h3>\n\n\n\n
            Create two EC2 instances or Azure Linux VMs using count<\/code>. Output all IDs.<\/p>\n\n\n\n
            Hint:<\/strong> count = 2<\/code>; use a splat expression in the output.<\/p>\n\n\n\n
            Exercise 2 — for_each<\/h3>\n\n\n\n
            Create resources for frontend<\/code>, backend<\/code>, and worker<\/code>, each with a different tag.<\/p>\n\n\n\n
            Hint:<\/strong> Use a map and each.key<\/code> \/ each.value<\/code>.<\/p>\n\n\n\n
            Exercise 3 — Filtering<\/h3>\n\n\n\n
            Given an object map containing enabled = true\/false<\/code>, create only enabled resources.<\/p>\n\n\n\n
            Hint:<\/strong><\/p>\n\n\n
            locals {\n  enabled_items = {\n    for<\/span> name, item in<\/span> var<\/span>.items : name<\/span> =><\/span> item\n    if<\/span> item.enabled\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
            Exercise 4 — Transform a list<\/h3>\n\n\n\n
            Convert [\"dev\", \"test\", \"prod\"]<\/code> to uppercase.<\/p>\n\n\n\n
            Answer:<\/strong><\/p>\n\n\n
            [for environment in var.environments : upper(environment)]\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
            Exercise 5 — Flatten<\/h3>\n\n\n\n
            Given a map of applications to environments, create one resource per app\/environment pair.<\/p>\n\n\n\n
            Hint:<\/strong> Build a nested list with nested for<\/code> expressions, call flatten()<\/code>, and then convert the result to a map keyed by a unique string.<\/p>\n\n\n\n
            Exercise 6 — Dynamic blocks<\/h3>\n\n\n\n
            Generate multiple AWS security group ingress rules from a list of objects.<\/p>\n\n\n\n
            Hint:<\/strong> Define a list of rule objects and use dynamic \"ingress\"<\/code> with for_each<\/code>.<\/p>\n\n\n\n
            Exercise 7 — Module iteration<\/h3>\n\n\n\n
            Call a local module once per item in a set of strings.<\/p>\n\n\n\n
            Hint:<\/strong> module \"example\" { for_each = var.items ... }<\/code>.<\/p>\n\n\n\n
            \n\n\n\n
            Final checklist<\/h2>\n\n\n\n
              \n
            • [ ] I can explain the difference between\u00a0count<\/code>\u00a0and\u00a0for_each<\/code>.<\/li>\n\n\n\n
            • [ ] I can use\u00a0for<\/code>\u00a0expressions to transform a collection.<\/li>\n\n\n\n
            • [ ] I can filter a map or list with\u00a0if<\/code>.<\/li>\n\n\n\n
            • [ ] I understand when\u00a0dynamic<\/code>\u00a0blocks are appropriate.<\/li>\n\n\n\n
            • [ ] I can flatten nested lists and generate combinations.<\/li>\n\n\n\n
            • [ ] I can read resource addresses in a Terraform plan.<\/li>\n\n\n\n
            • [ ] I checked all plans before applying.<\/li>\n\n\n\n
            • [ ] I destroyed all temporary cloud resources.<\/li>\n<\/ul>\n\n\n\n
              Key idea:<\/strong> count<\/code> and for_each<\/code> repeat resource or module instances; for<\/code> expressions transform collections; dynamic<\/code> blocks repeat nested configuration. Choose the construct that matches the job.<\/p>\n","protected":false},"excerpt":{"rendered":"
              Terraform Loops and Iteration \u2014 Summary Table # Option \/ Method Purpose Input Common use case Creates resources? 1 count Repeats a resource or module a specified… <\/p>\n","protected":false},"author":1,"featured_media":7795,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[5129],"tags":[5449,5497,5496,5130],"class_list":["post-7493","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-terraform","tag-devopsschool","tag-iterations","tag-looping","tag-terraform"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/7493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=7493"}],"version-history":[{"count":10,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/7493\/revisions"}],"predecessor-version":[{"id":79119,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/7493\/revisions\/79119"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media\/7795"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=7493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=7493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=7493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}