How to Use Terraform For_each: A Comprehensive Guide in 2024 with Examples

variable "vpcs" {
type = map(object({
cidr_block = string
instance_tenancy = string
}))
}

resource "aws_vpc" "my_vpc" {
for_each = var.vpcs

cidr_block = each.value.cidr_block
instance_tenancy = each.value.instance_tenancy

tags = {
Name = each.key
}
}

2. Create the same VPC resource for multiple environments

To create the same VPC resource for multiple environments, you can utilize Terraform workspaces or manage separate state files for each environment. Here’s how you can do it using separate state files:

1. Create directories for each environment:

terraform/
├── modules/
│ └── vpc/
│ ├── main.tf
│ ├── variables.tf
│ └── outputs.tf
├── prod/
│ ├── main.tf
│ ├── variables.tf
│ └── terraform.tfvars
└── dev/
├── main.tf
├── variables.tf
└── terraform.tfvars

2. Define the VPC module in the module directory (`modules/vpc`), as described in the previous response.

3. Define the environment-specific configurations  in the `prod` and `dev` directories:

`prod/main.tf`:

module "prod_vpc" {
source = "../modules/vpc"
cidr_block = var.prod_cidr_block
vpc_name = "prod-vpc"
}

`prod/variables.tf`:

variable "prod_cidr_block" {
description = "The CIDR block for the production VPC"
}

`dev/main.tf`:

module "dev_vpc" {
source = "../modules/vpc"
cidr_block = var.dev_cidr_block
vpc_name = "dev-vpc"
}

`dev/variables.tf`:

variable "dev_cidr_block" {
description = "The CIDR block for the development VPC"
}

4. Define the environment-specific variable values in the respective `terraform.tfvars` files:

`prod/terraform.tfvars`:

```hcl
prod_cidr_block = "10.0.0.0/16"
```

`dev/terraform.tfvars`:

```hcl
dev_cidr_block = "192.168.0.0/16"

Benefits of Using Terraformfor_eachattributes 

1. Cut down unwanted duplication

Using the terraform for_each attribute can cut down on unwanted duplication in the Terraform configurations.

2. Less time taking and more efficient 

Adding new features or items to the environment list or altering existing items is very quick as all the main items for configurable are stored at one place.

3. Can develop different patterns with same setup

You can also use some different patterns to develop the same setup as in this example, lile using Terraform workspaces. However, for_each can be applied more widely to dynamically create resources depending on maps, lists, or other resources.

Limitations with Terraform for_each attributes 

for_each keys that is the keys of a map, or values that is the values in a set, used for iteration cater as identifiers for the multiple resources they develop . As such, they are visible in the terraform UI output that is terraform plan or terraform apply steps and also in the state file as well. Hence, sensitive values cannot be utilize as arguments in for_each implementations. The sensitive values that can’t be used are:

1. Sensitive input variables: These are variables set to true with the sensitive argument.

2. Sensitive outputs: These are outputs set to true with the sensitive argument.

3. Sensitive resource attributes: These are the attributes with sensitive data marked as sensitive using the built-in sensitive function.

You will get an error if you try using sensitive values as for_each arguments.

Also, the keys or values of a for_eachhave to be known before a terraform apply operation. These values or keys cannot also rely on the result of any unnecessary function such as  timestamp as they are evaluated later on during the main evaluation step. Also, use descriptive value or keys. Since terraform for_each values identify resources, uses meaningful keys or values that eventually helps to easily identify resources.

count vs. for_each


While both count and for_each are used for looping in Terraform but offers different services. The count method is certainly used if you want to design a fixed number of identical resources. On the other hand, for_each is more convinient while dealing with resources that requires unique configurations.

It’s essential to note that count and terraform for_each are both exclusive, it means you cannot use them together for one single resource. However, there are workarounds to combine their functionalities.