Expressions and Functions

# Literal values
42
true
"hello"
["a", "b", "c"]
{ key = "value" }

# References
var.instance_type
local.name_prefix
aws_instance.web.public_ip
module.vpc.vpc_id
data.aws_ami.ubuntu.id
count.index
each.key / each.value
path.module / path.root / path.cwd
terraform.workspace

name     = "server-${var.environment}-${count.index}"
endpoint = "https://${aws_lb.api.dns_name}/api"

# Heredoc
user_data = <<-EOT
  #!/bin/bash
  echo "ENV=${var.environment}" >> /etc/app.conf
  systemctl start myapp
EOT

# Heredoc with template directives
hosts = <<-EOT
  %{ for ip in var.private_ips ~}
  ${ip}
  %{ endfor ~}
EOT

instance_type = var.is_prod ? "t3.large" : "t3.micro"
count         = var.enable_replica ? 2 : 0
subnet_id     = var.use_private ? aws_subnet.private.id : aws_subnet.public.id

# List → list
upper_names = [for s in var.names : upper(s)]

# List → list with filter
long_names = [for s in var.names : s if length(s) > 5]

# Map → map
upper_tags = { for k, v in var.tags : k => upper(v) }

# Map → list
tag_strings = [for k, v in var.tags : "${k}=${v}"]

# List → map (index as key)
indexed = { for i, v in var.names : i => v }

# Resource for_each → map output
instance_ids = { for k, v in aws_instance.app : k => v.id }

# Full splat — [*] — the modern form (shorthand for a for expression)
all_ips = aws_instance.web[*].private_ip
# Equivalent: [for o in aws_instance.web : o.private_ip]

# Splats don't nest — [*] only applies at one level.
# For list-of-lists attributes, flatten the result:
all_sg_ids = flatten(aws_instance.web[*].vpc_security_group_ids)

# Legacy attribute-only splat (pre-0.12) — avoid in new code
all_ips_legacy = aws_instance.web.*.private_ip

# try() — returns the first argument that evaluates without error
image = try(var.config.image, "nginx:latest")
port  = try(var.listeners[0].port, 8080)

# can() — true if the expression evaluates without error
validation {
  condition     = can(regex("^ami-", var.ami_id))
  error_message = "ami_id must start with \"ami-\"."
}

tostring(42)          # "42"
tonumber("42")        # 42
tobool("true")        # true
tolist(toset(["a"]))  # ["a"]

file("config/app.conf")           # read file as string
filebase64("certs/ca.pem")        # read and base64 encode
fileset(path.module, "files/*")   # list files matching glob

# templatefile() — render a template file with variables
user_data = templatefile("${path.module}/init.tftpl", {
  env  = var.environment
  port = 8080
})

# init.tftpl — same ${} interpolation and %{ for }/%{ if } directives as heredocs
#!/bin/bash
echo "ENV=${env}" >> /etc/app.conf
systemctl start "app-${port}"

cidrsubnet("10.0.0.0/16", 8, 0)   # => "10.0.0.0/24"
cidrsubnet("10.0.0.0/16", 8, 1)   # => "10.0.1.0/24"
cidrhost("10.0.0.0/24", 5)        # => "10.0.0.5"
cidrnetmask("10.0.0.0/24")        # => "255.255.255.0"

# Default value if null
name = coalesce(var.override_name, "default-name")
# First non-null, non-empty from list
region = coalesce(var.region, "us-east-1")

# Conditional resource creation
count = var.create_bucket ? 1 : 0

# Map lookup with default
size = lookup(local.size_map, var.environment, "t3.micro")

# Build subnet CIDRs dynamically
subnets = [for i in range(3) : cidrsubnet(var.vpc_cidr, 8, i)]

# Merge with override
final_tags = merge(local.default_tags, var.extra_tags)

# one() — assert list has exactly one element
vpc_id = one(data.aws_vpcs.selected.ids)