Terraform Dynamic Block Type Validator

Threat/Impact Level: MEDIUM | Exploitability/Downtime Risk: HIGH | Time to Fix: 5–15 mins

TL;DR

• What broke: Terraform encountered a dynamic block inside a resource attribute or nested block position that the provider schema does not expose as a repeatable block type — or the dynamic keyword was used at the top-level resource argument level where it is syntactically illegal.
• How to fix it: Move the dynamic block so it wraps only a legitimate repeatable nested block (e.g., ingress, egress, tag, setting) declared in the provider schema. Replace top-level argument iteration with for expressions or for_each on the resource itself.
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your failing .tf block and get corrected HCL without sending your config to a third-party server.

Error: Unsupported block type

  on main.tf line 14, in resource "aws_security_group" "this":
  14:   dynamic "description" {

Blocks of type "description" are not expected here.

How to Fix It (The Solution)

Identify the Offending Block

Run this to get the full schema for the resource and confirm which nested blocks are actually repeatable:

terraform providers schema -json | jq '.provider_schemas[].resource_schemas["aws_security_group"].block.block_types'

Only keys returned under block_types (not attributes) are valid dynamic block labels.

Basic Fix — Wrong Target Attribute

The most common mistake: wrapping a scalar attribute with dynamic instead of a nested block_type.

 resource "aws_security_group" "this" {
   name   = var.name
-  dynamic "description" {
-    for_each = var.descriptions
-    content {
-      description = description.value
-    }
-  }
+  description = var.descriptions[0]  # scalar — pick one value or join them
 }

If you genuinely need to iterate over ingress rules (a real block_type):

 resource "aws_security_group" "this" {
   name        = var.name
   description = var.description
+  dynamic "ingress" {
+    for_each = var.ingress_rules
+    content {
+      from_port   = ingress.value.from_port
+      to_port     = ingress.value.to_port
+      protocol    = ingress.value.protocol
+      cidr_blocks = ingress.value.cidr_blocks
+    }
+  }
 }

Enterprise Best Practice — Provider Version Pin + Schema Validation Gate

Provider schema changes between major versions silently invalidate dynamic blocks. Lock the provider and add a schema assertion:

 terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"-
-      version = ">= 3.0"
+      version = "~> 5.0"  # pin to known-good major; test upgrades in isolation
     }
   }
 }

For modules consumed by multiple teams, add an explicit lifecycle precondition to fail fast with a human-readable message instead of a cryptic schema error:

 resource "aws_security_group" "this" {
   name        = var.name
   description = var.description
+
+  lifecycle {
+    precondition {
+      condition     = length(var.ingress_rules) > 0
+      error_message = "ingress_rules must contain at least one rule object. Received empty list."
+    }
+  }
+
   dynamic "ingress" {
     for_each = var.ingress_rules
     content {
       from_port   = ingress.value.from_port
       to_port     = ingress.value.to_port
       protocol    = ingress.value.protocol
       cidr_blocks = ingress.value.cidr_blocks
     }
   }
 }

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .github/workflows/tf.yml
- name: Validate
  run: terraform validate
  working-directory: ./infra

tflint --init
tflint --plugin-dir ~/.tflint.d/plugins

checkov -d . --check CKV_TF_1  # enforces module version pinning, preventing schema drift

# policy/tf_provider_pin.rego
package terraform.providers

deny[msg] {
  provider := input.configuration.provider_config[_]
  not regex.match(`^~> \d+\.\d+$`, provider.version_constraint)
  msg := sprintf("Provider '%v' must use pessimistic constraint (~> X.Y). Got: %v", [provider.name, provider.version_constraint])
}

conftest test plan.json --policy policy/

tflint → terraform validate → conftest → terraform plan → checkov (on plan JSON) → terraform apply