Skip to content
Cheat sheets

004 · Domain 4: Terraform configuration · 13% of the exam

Task 4.5: Write dynamic configuration using expressions and functions

Conditionals, for expressions, splats, dynamic blocks, string templates, and built-in functions such as lookup, merge, flatten, try and templatefile; testing them in terraform console.

Study it

  • Expressions and functions: conditionals, for, dynamic blocks, templates

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

var.users is a list of objects with name and is_admin attributes. A local value must be a map from each admin's name to that user object. Which expression builds it?

  1. A[ for u in var.users : u.name => u if u.is_admin ]
  2. B{ for u in var.users : u if u.is_admin }
  3. C{ for u in var.users : u.name => u if u.is_admin }
  4. Dlookup(var.users, "is_admin", true)
Show the answer and why

  • A[ for u in var.users : u.name => u if u.is_admin ]

    Incorrect

    Square brackets produce a list, which cannot use the key => value form.

  • B{ for u in var.users : u if u.is_admin }

    Incorrect

    A map-producing for expression needs a key => value pair.

  • C{ for u in var.users : u.name => u if u.is_admin }

    Correct

    A for expression in braces produces a map with key => value, and the if clause filters elements.

  • Dlookup(var.users, "is_admin", true)

    Incorrect

    lookup reads one key from a map; it does not filter or transform a list.

Brackets make lists, braces make maps, and if filters either.

HashiCorp documentation

Task 4.5Report a problem with this question

Question 2 · choose 1

A monitoring resource should exist only when var.enable_monitoring is true. Which argument does this?

  1. Acount = var.enable_monitoring
  2. Benabled = var.enable_monitoring
  3. Ccount = var.enable_monitoring ? 1 : 0
  4. Ddepends_on = [var.enable_monitoring]
Show the answer and why

  • Acount = var.enable_monitoring

    Incorrect

    count needs a whole number, not a bool.

  • Benabled = var.enable_monitoring

    Incorrect

    There is no generic enabled meta-argument.

  • Ccount = var.enable_monitoring ? 1 : 0

    Correct

    A conditional expression chooses between two values, and count of 0 creates no instance.

  • Ddepends_on = [var.enable_monitoring]

    Incorrect

    depends_on lists resources and modules, not conditions.

condition ? 1 : 0 with count is the usual way to make a resource optional.

HashiCorp documentation

Task 4.5Report a problem with this question

Question 3 · choose 1

var.networks maps each network to a list of subnets. A resource must have one instance per network-subnet pair. Which function turns the nested lists into one list to build the for_each map?

  1. Amerge
  2. Bzipmap
  3. Ccompact
  4. Dflatten
Show the answer and why

  • Amerge

    Incorrect

    merge combines maps by key.

  • Bzipmap

    Incorrect

    zipmap builds a map from a list of keys and a list of values.

  • Ccompact

    Incorrect

    compact removes null and empty strings from a list.

  • Dflatten

    Correct

    flatten replaces nested lists with their elements, producing a single flat list.

Nested structures for for_each are usually flattened with a for expression and flatten, then turned into a map.

HashiCorp documentation

Task 4.5Report a problem with this question

Question 4 · choose 1

An instance's user_data is a shell script that needs the database address and a port inserted. The script lives in its own file. Which function renders it?

  1. Atemplatefile, with a map of variables
  2. Bfile, which replaces variables automatically
  3. Cjsonencode, which encodes the script with its variables
  4. Dformat, which reads the file and fills in placeholders
Show the answer and why

  • Atemplatefile, with a map of variables

    Correct

    templatefile reads a file and renders it as a template with the given variables.

  • Bfile, which replaces variables automatically

    Incorrect

    file returns the contents unchanged.

  • Cjsonencode, which encodes the script with its variables

    Incorrect

    jsonencode produces JSON text.

  • Dformat, which reads the file and fills in placeholders

    Incorrect

    format formats a string argument; it does not read files.

Keep templates in files and render them with templatefile.

HashiCorp documentation

Task 4.5Report a problem with this question

Question 5 · choose 1

An engineer wants to try cidrsubnet() with different arguments before using it in configuration. Which approach fits, and can a custom function be defined if the built-ins fall short?

  1. AUse terraform validate; custom functions go in a functions block
  2. BUse terraform plan -target; custom functions are defined in locals
  3. CUse terraform fmt; custom functions are written in Go next to the configuration
  4. DUse terraform console; only built-in and provider-defined functions exist
Show the answer and why

  • AUse terraform validate; custom functions go in a functions block

    Incorrect

    There is no functions block for user-defined functions.

  • BUse terraform plan -target; custom functions are defined in locals

    Incorrect

    Locals hold values, not function definitions.

  • CUse terraform fmt; custom functions are written in Go next to the configuration

    Incorrect

    Configurations cannot define functions.

  • DUse terraform console; only built-in and provider-defined functions exist

    Correct

    You can experiment with functions in terraform console; the language does not support user-defined functions.

console is the scratch pad for expressions and functions.

HashiCorp documentation

Task 4.5Report a problem with this question

Question 6 · choose 1

A VPC uses 10.0.0.0/16. What does cidrsubnet("10.0.0.0/16", 8, 2) return?

  1. A10.2.0.0/24
  2. B10.0.2.0/24
  3. C10.0.0.2/8
  4. D10.0.8.0/18
Show the answer and why

  • A10.2.0.0/24

    Incorrect

    The new bits extend the prefix after the existing 16 bits.

  • B10.0.2.0/24

    Correct

    Adding 8 bits to the /16 prefix gives /24 networks, and network number 2 is 10.0.2.0/24.

  • C10.0.0.2/8

    Incorrect

    newbits extends the prefix; it is not the new prefix length.

  • D10.0.8.0/18

    Incorrect

    The prefix grows by 8 bits, to /24.

cidrsubnet(prefix, newbits, netnum) carves numbered subnets out of a network.

HashiCorp documentation

Task 4.5Report a problem with this question

Practise domain 4 →Practise all domains →