A consolidated reference of every HCL language feature this repo uses, with a pointer to where you saw it. Use this as a cheat sheet.
Expressions and references
| Feature | Looks like | Meaning |
|---|---|---|
| Attribute reference | aws_vpc.this.id |
The id of resource aws_vpc.this. |
| Variable / local / module | var.x, local.y, module.z.out |
Read an input, a local, a module output. |
| Data source reference | data.aws_region.current.name |
A value looked up, not created. |
| String interpolation | "${var.project}-${var.environment}" |
Insert values into a string. |
| Ternary (conditional) | var.single_nat_gateway ? 1 : var.az_count |
cond ? a : b. |
| Splat | aws_subnet.app[*].id |
Collect id from every count instance into a list. |
| Index | local.azs[count.index] |
Pick one element of a list. |
Meta-arguments (special arguments on any resource/module)
| Meta-arg | Where in repo | Purpose |
|---|---|---|
count |
aws_subnet.app (networking) |
Make N copies; access index with count.index. |
for_each |
aws_vpc_endpoint.interface (networking) |
One instance per set/map element; access with each.value/each.key. |
depends_on |
aws_nat_gateway.this (networking) |
Force an explicit ordering when there's no reference to infer it. |
providers |
module.edge (envs/dev) |
Hand specific (aliased) providers to a module. |
dynamic |
stage in aws_codepipeline (iac-pipeline) |
Generate nested blocks conditionally/repeatedly. |
lifecycle |
(available; used as the project grows) | Control create/destroy behavior, e.g. force_destroy. |
Built-in functions seen in this repo
| Function | Example here | What it does |
|---|---|---|
merge(a, b) |
tags everywhere | Combine maps; later keys win. |
coalesce(a, b) |
platform/main.tf account IDs |
First non-null argument. |
slice(list, from, to) |
local.azs (networking) |
Sub-list. |
cidrsubnet(cidr, newbits, num) |
subnet CIDRs (networking) | Carve a smaller CIDR out of a bigger one. |
concat(l1, l2) |
S3 endpoint route tables (networking) | Join lists. |
toset(list) |
interface endpoints for_each (networking) |
Convert a list to a set. |
tolist(set) |
module.redis...[0] (envs/dev) |
Convert a set to a list (so you can index it). |
contains(list, x) |
environment validation (bootstrap) |
Membership test. |
substr(s, off, len) |
connection name (iac-pipeline) | Substring (here, to cap a name at 32 chars). |
Version constraints
You'll see version strings like ~> 5.70 and >= 1.10.0. The operators:
>= 1.10.0- this version or newer.~> 5.70- "pessimistic" constraint: allow5.70and any later5.xpatch/minor up to (but not including)6.0. It lets you get fixes without an accidental major-version jump that could break things.
These guard against a provider or OpenTofu upgrade silently changing behavior.