Task 1.1: Translate business requirements into infrastructure code

• Afor_each over a map of zone => subnet number, using cidrsubnet(var.vpc_cidr, 4, each.value)

  Correct

  Each zone keeps the subnet number written next to it, so removing a map entry destroys only that zone's subnet and leaves every other range and instance key untouched.

• Bcount = length(var.zones), with cidr_block = cidrsubnet(var.vpc_cidr, 4, count.index)

  Incorrect

  Removing a zone from the middle of the list shifts every later index, so later subnets get new instance addresses and new ranges, which forces their replacement.

• Cfor_each = toset(var.zones), with cidr_block = cidrsubnet(var.vpc_cidr, 4, index(var.zones, each.key))

  Incorrect

  The keys are stable, but the subnet number still comes from the zone's position in the list, so retiring an earlier zone renumbers the ranges of the zones after it.

• DOne cidrsubnets(var.vpc_cidr, 4, 4, 4) call, with each zone's subnet taking its own element

  Incorrect

  cidrsubnets numbers its results by position; removing an argument for a retired zone shifts the ranges allocated after it, which the requirement forbids.

A range that must survive changes to its neighbours needs an identity that does not depend on list position. Keying instances by zone and storing an explicit subnet number per zone keeps both the instance address and the calculated CIDR stable when entries are added or removed.

• Alookup(local.sizes, var.environment, "t3.small")

  Incorrect

  lookup returns the default when the key is missing, so an unknown environment silently gets t3.small instead of stopping the plan.

• Blocal.sizes[var.environment]

  Correct

  Indexing a map with a key it does not contain is an evaluation error, so the plan stops for an environment without an entry, and new environments need only a new map entry.

• Ctry(local.sizes[var.environment], local.sizes["dev"])

  Incorrect

  try returns the first expression that succeeds, so a missing key falls back to the dev size instead of stopping the plan.

• DA validation block with contains(["dev", "stage", "prod"], var.environment)

  Incorrect

  It stops unknown names, but the hard-coded list must be edited alongside the map, which breaks the rule that a new map entry is enough.

Map indexing fails loudly on a missing key, which is exactly the behavior wanted here. lookup with a default and try with a fallback both turn the same mistake into a silent default.

• Aanytrue([for c in var.allowed_cidrs : can(cidrhost(c, 0))])

  Incorrect

  anytrue returns true when at least one element is true, so a list with one valid and one broken prefix passes.

• Balltrue([for c in var.allowed_cidrs : can(cidrhost(c, 0))])

  Correct

  The for expression tests each entry, can turns a cidrhost error into false, and alltrue is true only when every element is true.

• Ccan(cidrhost(var.allowed_cidrs, 0))

  Incorrect

  cidrhost expects one prefix string, not a list, so the call always errors and can returns false even for a valid list.

• Dlength(var.allowed_cidrs) > 0 && can(cidrhost(var.allowed_cidrs[0], 0))

  Incorrect

  It checks that the list has entries and that the first one is valid, so a broken prefix later in the list passes.

A rule about every element of a collection translates into a for expression that tests each element, combined with alltrue. alltrue also returns true for an empty collection, so add a length check if the list must not be empty.

• Alist(string)

  Incorrect

  for_each does not convert lists to sets, so a list needs toset() first.

• Btuple([string])

  Incorrect

  A tuple is an ordered sequence, and for_each accepts only a map or a set of strings.

• Cmap(any)

  Incorrect

  A map would need a key and a value for each user, which the caller does not have.

• Dset(string)

  Correct

  HashiCorp suggests declaring set(string) for a variable that a module uses directly in for_each, so no conversion is needed.

for_each takes a map or a set of strings. When a module's input is a collection of unique names, declaring it as set(string) states that intent and avoids toset() at every use.

• Asetproduct(var.environments, var.apps)

  Correct

  setproduct returns every combination of elements from the given collections, one pair per environment and application.

• Bconcat(var.environments, var.apps)

  Incorrect

  concat joins the two lists end to end; it does not pair their elements.

• Czipmap(var.environments, var.apps)

  Incorrect

  zipmap pairs elements by position into a map, so each environment gets only one application.

• Dflatten([var.environments, var.apps]) over both lists

  Incorrect

  flatten removes nesting and returns one flat list of names, not combinations.

For "every X with every Y" requirements, setproduct gives the Cartesian product; project it into a map with a unique key per pair before using it in for_each.

• Aelement(data.aws_availability_zones.available.names, var.az_count)

  Incorrect

  element returns a single element at one index, not the first N elements.

• Bchunklist(data.aws_availability_zones.available.names, var.az_count)

  Incorrect

  chunklist regroups every name in the list instead of selecting the first N names.

• Cslice(data.aws_availability_zones.available.names, 0, var.az_count)

  Correct

  slice takes consecutive elements from the start index up to, but not including, the end index.

• Dsubstr(data.aws_availability_zones.available.names, 0, var.az_count)

  Incorrect

  substr works on a string, not on a list of zone names.

slice(list, start, end) is the list counterpart of substr; the end index is exclusive, so slice(names, 0, 3) returns three names.