Built-in Functions

Terraform ships a library of built-in functions for strings, collections, encoding, filesystem, date, and crypto — merge, lookup, coalesce, jsonencode, templatefile, cidrsubnet, and dozens more. There are no user-defined functions in core HCL — provider-defined functions arrived in 1.8 — so this fixed library plus expressions is your whole toolbox for transforming data.

That constraint shapes how you write Terraform. You cannot define a helper to factor out a repeated transformation, so the skill is recognizing which built-in already does what you want. Most "I wish I could write a function for this" moments dissolve into a merge, a for expression, or a templatefile once you know the library.

Collection Functions

merge combines maps with later keys winning, concat joins lists, flatten collapses nested lists, and lookup reads a map key with a fallback. keys, values, and contains inspect a collection. These are the workhorses for reshaping the data that feeds for_each and dynamic blocks.

locals {
  all_tags = merge(var.default_tags, var.extra_tags)

  # lookup with a default avoids erroring on a missing key
  size = lookup(var.sizes, var.environment, "t3.micro")
}

String Functions

format builds a string from a template and arguments, join and split convert between a list and a delimited string, replace substitutes text, and lower/upper/trimspace normalize. These keep name construction readable instead of a pile of nested interpolations.

locals {
  name     = format("%s-%s-%03d", var.project, var.environment, var.index)
  az_list  = join(",", var.availability_zones)
  slug     = lower(replace(var.display_name, " ", "-"))
}

Encoding Functions

jsonencode and yamlencode turn an HCL value into a correctly-escaped JSON or YAML string, and their decode counterparts parse one back. This is the right way to build an IAM policy or a config document — you write the structure as native HCL and let the function produce valid serialized text, instead of concatenating braces and quotes by hand.

resource "aws_iam_role_policy" "app" {
  role   = aws_iam_role.app.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = "${aws_s3_bucket.data.arn}/*"
    }]
  })
}

Filesystem and Template Functions

file reads a file's contents into a string, and templatefile renders a separate template file with a map of variables — the clean way to produce user-data or a config file. Keeping the template in its own file, rather than inline as a heredoc, makes it readable and lets editors highlight it correctly.

resource "aws_instance" "web" {
  ami           = "ami-0abc123"
  instance_type = "t3.micro"
  user_data     = templatefile("${path.module}/init.sh.tftpl", {
    app_env = var.environment
    port    = 8080
  })
}

Network and Numeric Functions

cidrsubnet carves a subnet out of a larger CIDR block by adding bits and selecting an index, and cidrhost returns a specific host address within a range. Computing these by hand is how overlapping or wrong ranges slip in; the functions make subnet math deterministic. min, max, ceil, and floor round out the numeric set.

locals {
  # /16 base, add 8 bits to get /24s, by index
  subnet_a = cidrsubnet("10.0.0.0/16", 8, 0)   # 10.0.0.0/24
  subnet_b = cidrsubnet("10.0.0.0/16", 8, 1)   # 10.0.1.0/24
}