A security group uses dynamic "ingress" with for_each = var.rules, where var.rules is a list of objects with port and cidr attributes, and content sets from_port = ingress.value.port. One generated rule has the wrong port. Inside content, what do ingress.key and ingress.value refer to?
Select an answer to reveal the explanation.
Short Explanation
Inside a dynamic block, the iterator is your tour guide: key tells you where you are, and value tells you what you're looking at. For a list, where you are is just a position number. The trap is mixing up a list's index with a set, where key and value really are the same thing.
Full Explanation
A dynamic block generates one nested block per element of its for_each collection and exposes a temporary iterator, named after the block label unless the iterator argument renames it. The iterator has two attributes: key, which is the map key or list element index of the current element, and value, which is the element itself. For a list of objects, ingress.key is 0, 1, 2 and so on, and ingress.value is the full rule object, so ingress.value.port and ingress.value.cidr reach its attributes. Tracing a bad port therefore means finding the element at the index whose object carries the wrong value in var.rules or whatever builds it. The iterator does not unpack object attributes into key and value; those names describe the collection's structure, not the element's contents. key and value are identical only when the collection is a set, where an element has no separate key. The iterator never refers to the enclosing resource; it describes only the current element. Exam caveat: overusing dynamic blocks hides configuration, so HashiCorp suggests them mainly for reusable modules. Operational check: in terraform console, evaluate var.rules and index into it to find the element with the wrong port.