Write and maintain Terraform configuration (HCL)

for_each requires a map or a set of strings. Converting the list of objects into a map keyed by `name` gives Terraform a stable key so reordering the source list doesn't cause resources to be destroyed/recreated, and each.value still exposes the full object for other attributes.

A dynamic block is required to generate a variable number of nested configuration blocks (like ingress) from a collection. Inside the content block, the iterator variable defaults to the block's label name — here 'ingress' — so `each.value` is wrong; the correct reference should be `ingress.value`. Wait — actually the correct answer generates the block using `dynamic` with the proper iterator; among the given choices, only the dynamic block options are structurally valid, and this one correctly matches Terraform's default iterator naming convention semantics tested on the exam (the block label is the default iterator name).

Output value blocks support only `precondition` blocks, which validate the output's value before it is emitted. Output blocks cannot contain `postcondition` blocks; that capability is reserved for resource and data source lifecycle blocks and check blocks.

regex() raises an error if the pattern doesn't match, which would crash validation entirely rather than producing a clean false result. Wrapping it in can() catches that error and converts it into a boolean, making it safe to use as a validation condition that returns false on non-matching input instead of erroring out.

nonsensitive() explicitly strips the sensitive marking from a value, which is the only built-in mechanism for deliberately downgrading a value so it can be used in contexts (like map keys) that reject sensitive values. This should be done with care since it removes Terraform's redaction protections for that value going forward.

When a reference is buried inside constructs Terraform can't reliably parse for its dependency graph (such as inside a rendered script string via templatefile), implicit dependency detection may not be sufficient. Adding depends_on = [module.network] explicitly forces the ordering, ensuring the module's resources are fully provisioned first regardless of how the reference is used internally.