Two ingress rules
Converts, and the iterator is named after the block rather than being each
resource "aws_security_group" "web" {
ingress {
from_port = 80
to_port = 80
}
ingress {
from_port = 443
to_port = 443
}
}Terraform dynamic Block Generator
Turn repeated nested blocks into a dynamic block and the locals that feeds it. One detail catches everybody exactly once, and it is the iterator name.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Convert. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
Rules that set different attributes
Every iteration produces the same shape, so the odd one out needs a null
resource "aws_security_group" "web" {
ingress {
from_port = 80
description = "http"
}
ingress {
from_port = 443
}
}A repeated lifecycle block
Meta-argument blocks are built before any expression is evaluated, so they cannot be dynamic
resource "aws_instance" "web" {
lifecycle {
ignore_changes = [tags]
}
lifecycle {
ignore_changes = [ami]
}
}Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Writing each.value inside a dynamic block
The iterator is named after the block, so it is ingress.value. The error says each is not available, which sends people to look for a missing for_each on the resource.
Instead:Use ingress.key and ingress.value, or set iterator = "x" and use x.value.
Converting a block that appears once
It adds a data structure and an indirection and removes nothing, so the resource gets harder to read for no benefit.
Instead:Convert when the number of blocks varies with a variable. Leave literal repetition literal.
Building the list from entries that do not all set the same attributes
Every iteration produces the same shape, so an attribute missing from one entry is an error rather than an omission.
Instead:Set the absent ones to null explicitly, and check the provider treats null as absent for that argument.
The iterator is named after the block, not each
Inside dynamic "ingress" the variable is ingress.value. Writing each.value gives an error saying each is not available, which reads like the resource is missing a for_each rather than like the wrong name.
for_each and content, and nothing else
A dynamic block has exactly two parts: for_each, and a content block holding what one iteration produces. Attributes written directly inside the dynamic block rather than inside content are reported as unsupported arguments, which does not point at the missing wrapper.
Set iterator when the default name is awkward
iterator = "rule" makes it rule.key and rule.value. Worth doing when the block name is long, and necessary when one dynamic block is nested inside another, because two levels both named after their block cannot both be reached.
Every iteration produces the same shape
So an attribute only some of the original blocks set has to appear in all of them, usually as null. A missing key in the map is an error rather than an omission, and it is the thing that breaks a conversion done by hand.
Some blocks can never be dynamic
lifecycle, provider, provisioner and connection, along with count, for_each and depends_on. Terraform builds the resource's own structure before any expression is evaluated, so those have to be literal. A lifecycle block in particular has to be written out, ignore_changes list included.
Use them sparingly, which is HashiCorp's own guidance
A dynamic block hides the resource's shape behind a data structure, so what a plan produces is no longer readable from the resource. That is a fair trade when the number of blocks genuinely varies with a variable, and a bad one for three fixed rules somebody found repetitive.
What this cannot see
Whether the provider accepts null for the attributes that are uneven, or whether the resulting resource is the one you meant. It converts the structure, in your browser, and runs nothing.
More terraform tools
Terraform Validator & Formatter Does it parse, and is it formatted? Terraform check and precondition Generator A failed check does not stop the apply Terraform variables.tf Generator From the var. references you already wrote Terraform Unused Declaration Linter Dead variables, locals and data sources Terraform Atlantis YAML Generator when_modified misses your modules Terraform Function Tester and HCL Console terraform console, in a tab Terraform for Expression Tester Where do the keys collide? Terraform Interpolation Tester null becomes an empty string Terraform templatefile Tester Render it before you apply it Terraform Resource Count Calculator How many objects, not how many blocks Terraform count to for_each Converter With the moved blocks it needs Terraform moved Block Generator Rename without destroying Terraform state mv Command Builder No plan, no undo Terraform target Flag Builder And why to stop using it Terraform outputs.tf Generator Outputs are not sensitive by default Terraform Remote State Data Source Generator It grants read of the whole state Terraform Provider Block Generator docker is not hashicorp/docker Terraform .gitignore Generator and Checker .terraform* eats the lock file Terraform to OpenTofu Migration Checker The state is the part to watch Terraform tfvars to JSON Converter The JSON file wins Terraform Version Constraint Parser What ~> actually allows Terraform Resource Address Parser Quote it before the shell eats it Terraform cidrsubnet Calculator newbits is added, not the target Terraform Import Block Generator The id is not the name Terraform Lock File Viewer Why CI fails and your laptop does not Terraform Variables Checker A missing value hangs CI Terraform tfvars to Env Vars Converter Lists and maps have to be JSON Terraform Deprecated Syntax Checker What a current Terraform rejects Terraform State File Viewer Read it without uploading it Terraform Plan JSON Viewer It is not redacted Terraform HCL to JSON Converter And what the conversion loses Terraform Module Source Validator version only works for the registry Terraform Backend Config Decoder Is state actually locked? Terraform Naming Convention Validator A hyphen makes a resource unreferenceable