Expressions and Functions

# Literals
42            3.5           true          "hello"
["a", "b"]                  { key = "value" }
null                        # explicit absence, not the empty string

# References
var.instance_type           # input variable
local.name_prefix           # local value
aws_instance.web.public_ip  # managed resource attribute
aws_instance.web["a"].id    # for_each instance
aws_instance.web[0].id      # count instance
data.aws_ami.al2023.id      # data source
module.vpc.vpc_id           # module output
each.key / each.value       # inside a for_each block
count.index                 # inside a count block
self.private_ip             # only in provisioners and connection blocks

name     = "server-${var.environment}-${count.index}"
endpoint = "https://${aws_lb.api.dns_name}/api"
literal  = "cost is $${amount}"     # $$ escapes an interpolation

# Indented heredoc: <<- strips the common leading whitespace
user_data = <<-EOT
  #!/bin/bash
  echo "ENV=${var.environment}" >> /etc/app.conf
  systemctl start myapp
EOT

# Template directives. The ~ trims the adjacent whitespace and newline.
hosts = <<-EOT
  %{ for ip in var.private_ips ~}
  ${ip} node
  %{ endfor ~}
EOT

acl = <<-EOT
  %{ if var.public }allow all%{ else }deny all%{ endif }
EOT

# templatefile(): render a file from disk
user_data = templatefile("${path.module}/init.tftpl", {
  env  = var.environment
  port = 8080
})

# templatestring() (1.9+): render a template that arrives at runtime
rendered = templatestring(data.aws_s3_object.tpl.body, { env = "prod" })

instance_type = var.is_prod ? "t3.large" : "t3.micro"
count         = var.enable_replica ? 2 : 0

# try(): first argument that evaluates without error
image = try(var.config.image, "nginx:latest")
port  = try(var.listeners[0].port, 8080)

# can(): true if the expression evaluates at all, for validation
condition = can(regex("^ami-", var.ami_id))

# coalesce(): first non-null, non-empty argument
name = coalesce(var.override_name, var.name, "default")

# one(): null for an empty list, the element for exactly one, error for more
vpc_id = one(data.aws_vpcs.selected.ids)

# list → list
upper_names = [for s in var.names : upper(s)]

# list → list, filtered
long_names  = [for s in var.names : s if length(s) > 5]

# map → map (note the => )
upper_tags  = { for k, v in var.tags : k => upper(v) }

# map → list
tag_strings = [for k, v in var.tags : "${k}=${v}"]

# list → map, keyed by an attribute
by_name = { for u in var.users : u.name => u }

# grouping mode: ... collects duplicates into a list per key
by_az = { for s in var.subnets : s.az => s.id... }

# resource instances → map of ids
instance_ids = { for k, v in aws_instance.app : k => v.id }

# Splat: shorthand for a single-level for expression
all_ips = aws_instance.web[*].private_ip
# same as: [for o in aws_instance.web : o.private_ip]

# Splats do not nest. Flatten a list-of-lists attribute:
all_sgs = flatten(aws_instance.web[*].vpc_security_group_ids)

# Legacy attribute-only splat, avoid in new code
old = aws_instance.web.*.private_ip

# The canonical fileset + for_each upload pattern
resource "aws_s3_object" "site" {
  for_each = fileset("${path.module}/site", "**/*")

  bucket = aws_s3_bucket.site.id
  key    = each.value
  source = "${path.module}/site/${each.value}"
  etag   = filemd5("${path.module}/site/${each.value}")
}

tostring(42)              # "42"
tonumber("42")            # 42
tobool("true")            # true
toset(["a", "a", "b"])    # a set, order is lost
tolist(toset(["a"]))      # ["a"]
tomap({ a = 1 })          # a map, all values coerced to one type

type(var.thing)           # a printable type name, for debugging
convert(var.x, list(string))   # explicit inline conversion (1.15+)

cidrsubnet("10.0.0.0/16", 8, 0)     # "10.0.0.0/24"
cidrsubnet("10.0.0.0/16", 8, 1)     # "10.0.1.0/24"
cidrsubnets("10.0.0.0/16", 8, 8, 4) # several at once, packed in order
cidrhost("10.0.0.0/24", 5)          # "10.0.0.5"
cidrnetmask("10.0.0.0/24")          # "255.255.255.0"

locals {
  name_prefix = "${var.project}-${var.environment}"

  common_tags = {
    Project     = var.project
    Environment = var.environment
    ManagedBy   = "terraform"
  }

  # Locals may reference earlier locals in the same or another block
  bucket_name = "${local.name_prefix}-assets"

  # A lookup table beats a chain of ternaries
  instance_size = {
    dev  = "t3.micro"
    prod = "m6i.large"
  }[var.environment]

  subnet_cidrs = [for i in range(var.az_count) :
    cidrsubnet(var.vpc_cidr, 8, i)]
}

# for_each cannot take a sensitive value, so a sensitive map key
# needs an explicit nonsensitive() and a reason in a comment
resource "aws_ssm_parameter" "cfg" {
  for_each = nonsensitive(var.config)   # keys are names, not secrets
  name     = each.key
  type     = "SecureString"
  value    = each.value
}

# Toggle a resource
count = var.create_bucket ? 1 : 0

# Merge defaults with per-caller overrides
tags = merge(local.common_tags, var.extra_tags)

# Nested for_each over two lists
locals {
  pairs = { for p in setproduct(var.envs, var.regions) :
    "${p[0]}-${p[1]}" => { env = p[0], region = p[1] } }
}

# Flatten a map of lists into a flat list of objects for for_each
locals {
  rules = flatten([
    for sg, ports in var.sg_ports : [
      for p in ports : { sg = sg, port = p }
    ]
  ])
}

# Turn a list of objects into a keyed map so for_each is stable
by_id = { for r in local.rules : "${r.sg}-${r.port}" => r }

# Read a JSON config file into HCL
cfg = jsondecode(file("${path.module}/config.json"))