A module receives a variable named ingress_ports holding a list of port numbers. The author wants a single aws_security_group resource to generate one ingress block per port without duplicating the block by hand. Which construct should populate the repeated ingress blocks?
variable "ingress_ports" {
type = list(number)
default = [22, 80, 443]
}
resource "aws_security_group" "web" {
name = "web"
# repeated ingress blocks go here
}- AA dynamic "ingress" block that iterates with for_each over var.ingress_ports and sets the port fields from each.value. Correct
- BA count = length(var.ingress_ports) argument on the aws_security_group resource, indexing var.ingress_ports[count.index] inside one ingress block.
- CA for expression written directly as ingress = [for p in var.ingress_ports : p], assigning the list to the ingress argument.
- DA separate aws_security_group_rule resource with for_each, leaving the aws_security_group with no ingress blocks at all.
Why A is correct: A dynamic block generates a nested configuration block once per element of its for_each collection, so it produces one ingress block per port using each.value, which is exactly the requirement.
Why B is wrong: count on the resource would create several separate security groups rather than several ingress blocks inside one group, so it multiplies the wrong object.
Why C is wrong: A for expression builds a value such as a list or map, but ingress is a nested block rather than an argument that accepts a list, so this assignment is invalid here.
Why D is wrong: Splitting rules into a separate resource can work but changes the design away from repeating nested blocks within the group, which is what the question asks the practitioner to achieve.