Expressions and Operators

HCL expressions are how you compute values — arithmetic, comparison, logical operators, string templates, and references. They are the connective tissue between resources: an expression reads one resource's attribute, transforms it, and feeds it to another. Knowing what's available — and what isn't, because HCL is expression-based rather than a full language — keeps configs clean.

The mistake worth heading off early is building structured text by hand. The temptation to construct an IAM policy or a JSON document with string concatenation ends in invalid output the first time a value contains a quote or a special character. Expressions are for computing values; structured documents belong to the encoding functions covered next.

Operators and Precedence

HCL has arithmetic operators (+, -, *, /, %), comparison operators (==, !=, <, >), and logical operators (&&, ||, !). They follow conventional precedence — multiplication before addition, comparison before logical-and — but a compound boolean reads more clearly when you parenthesize intent rather than trusting a reader to recall the table.

locals {
  # parenthesize compound booleans for explicit intent
  is_prod_ha  = (var.environment == "prod") && (var.replica_count > 1)
  subnet_bits = var.large_network ? 8 : 4
}

String Templates and Directives

Interpolation with ${...} embeds a value inside a string, and template directives %{if} and %{for} add inline conditionals and loops within a string. Directives are handy for a one-line user-data tweak, but building a whole collection inside a string template is harder to read than a for expression that produces the structure directly.

locals {
  bucket_name = "${var.project}-logs-${var.environment}"

  greeting = "Hosts: %{ for h in var.hosts }${h} %{ endfor }"
}

References and Traversal

A reference walks into a value: aws_instance.web.private_ip reads an attribute, var.subnets[0] indexes a list, and var.config["region"] indexes a map by key. List indexing is positional and errors on an out-of-range index; map indexing is by key and errors on a missing key unless you use lookup with a default. The distinction matters the moment a collection might not contain what you assume.

Type Behavior and null

Operators coerce compatible types — a number used in a string context becomes its string form — and null threads through expressions in ways that surprise people. A null argument means "use the provider default" rather than "set to empty", and a null flowing into an operator often produces a confusing error rather than a sensible fallback. When a value can be null, handle it explicitly with coalesce or a conditional rather than letting it propagate.

Heredocs for Multi-line Strings

A heredoc with <<-EOT holds a multi-line string — a user-data script, a templated policy document — without escaping every newline. The dash form strips leading indentation so the block can sit indented in the config and still produce a clean string. Heredocs are for literal multi-line text; for structured JSON, reach for jsonencode instead of writing the braces by hand.

resource "aws_instance" "web" {
  ami           = "ami-0abc123"
  instance_type = "t3.micro"
  user_data     = <<-EOT
    #!/bin/bash
    echo "env=${var.environment}" > /etc/app.env
    systemctl restart app
  EOT
}