Terraform Functions Quick Reference

Comprehensive reference of all Terraform built-in functions organized by category. Use this skill to quickly identify which function to use for a specific task and where to find detailed documentation.

When to Use This Skill

• •User asks "what terraform functions are available"
• •Questions about function categories or groups
• •"How to manipulate strings/lists/maps in terraform"
• •Looking for the right function for a specific task
• •Need to know function signature or basic usage
• •Want to explore available functions by category

Function Overview

Terraform includes 100+ built-in functions that you can use in expressions. Functions transform and combine values.

General syntax:

function_name(arg1, arg2, ...)

Example:

locals {
  uppercase_name = upper(var.name)
  combined_list  = concat(var.list1, var.list2)
  json_data      = jsondecode(file("config.json"))
}

Testing functions: Use terraform console to experiment:

$ terraform console
> upper("hello")
"HELLO"
> length([1, 2, 3])
3

Function Categories

Functions are organized into these categories:

1. •Numeric Functions - Mathematical operations
2. •String Functions - String manipulation
3. •Collection Functions - List, map, and set operations
4. •Encoding Functions - Encode/decode data formats
5. •Filesystem Functions - Read files and paths
6. •Date and Time Functions - Date/time manipulation
7. •Hash and Crypto Functions - Hashing and encryption
8. •IP Network Functions - CIDR and IP calculations
9. •Type Conversion Functions - Convert between types
10. •Validation Functions - Validate and test values
11. •Provider Functions - Provider-specific functions (Terraform provider)

Numeric Functions

Mathematical operations on numbers.

String Functions

String manipulation and formatting.

Collection Functions

Operations on lists, maps, and sets.

Encoding Functions

Encode and decode various data formats.

Filesystem Functions

Read files and manipulate paths.

Date and Time Functions

Date and time manipulation.

⚠️ Note: timestamp() is evaluated every time Terraform runs, causing perpetual differences. Use plantimestamp() for consistent plan-time timestamps.

Hash and Crypto Functions

Hashing and cryptographic operations.

⚠️ Note: uuid() generates a new value each run, causing perpetual differences. Use only when necessary (e.g., with lifecycle ignore_changes).

IP Network Functions

CIDR and IP address calculations.

Type Conversion Functions

Convert values between types.

Validation and Testing Functions

Validate values and test conditions.

Provider-Defined Functions (Terraform Provider)

Built-in provider-specific functions from the terraform provider.

Note: Provider-specific functions use the provider::<name>::<function> syntax and require the provider to be declared in required_providers.

Common Usage Patterns

String Manipulation

# Normalize naming
locals {
  normalized_name = lower(replace(var.name, "_", "-"))
  env_upper       = upper(var.environment)
}

# Template rendering
locals {
  user_data = templatefile("${path.module}/user-data.sh", {
    region      = var.region
    environment = var.environment
  })
}

Collection Operations

# Merge configurations
locals {
  default_tags = {
    Environment = var.environment
    ManagedBy   = "Terraform"
  }

  all_tags = merge(local.default_tags, var.additional_tags)
}

# Filter and transform
locals {
  public_subnets = [
    for subnet in var.subnets : subnet.id
    if subnet.public == true
  ]
}

# Safely access with one()
locals {
  bucket = try(one(aws_s3_bucket.logs), null)
}

File and Path Operations

# Read configuration files
locals {
  config = jsondecode(file("${path.module}/config.json"))

  ssl_cert = fileexists("${path.module}/cert.pem") ?
    file("${path.module}/cert.pem") : null
}

# Hash for change detection
resource "aws_s3_object" "config" {
  bucket = aws_s3_bucket.config.id
  key    = "config.json"
  source = "${path.module}/config.json"
  etag   = filemd5("${path.module}/config.json")
}

Type Conversion and Validation

# Safe type conversion
locals {
  port = can(tonumber(var.port)) ? tonumber(var.port) : 8080
}

# Validation with can()
variable "ami_id" {
  type = string

  validation {
    condition     = can(regex("^ami-[a-f0-9]{8,}$", var.ami_id))
    error_message = "AMI ID must be valid format (ami-xxxxxxxx)."
  }
}

# Try with fallbacks
locals {
  db_endpoint = try(
    aws_db_instance.primary.endpoint,
    aws_db_instance.replica.endpoint,
    "localhost:5432"
  )
}

Network Calculations

# Calculate subnets
locals {
  vpc_cidr = "10.0.0.0/16"

  # Create /24 subnets
  subnet_cidrs = cidrsubnets(local.vpc_cidr, 8, 8, 8, 8)

  # Calculate specific IPs
  nat_gateway_ip = cidrhost(local.subnet_cidrs[0], 5)
}

Finding More Information

Official Documentation:

• •Function Calls Overview
• •All Functions Index

Testing Functions:

# Interactive console
terraform console

# Example session
> upper("hello")
"HELLO"

> cidrsubnet("10.0.0.0/16", 8, 1)
"10.0.1.0/24"

> merge({a = 1}, {b = 2})
{
  "a" = 1
  "b" = 2
}

Getting Function Signatures:

# List all functions with signatures (Terraform v1.4+)
terraform metadata functions -json

Best Practices

Do's

✅ Use descriptive variable names when using complex function chains

# Good
locals {
  normalized_bucket_name = lower(replace(var.bucket_name, "_", "-"))
}

# Avoid
locals {
  bn = lower(replace(var.bn, "_", "-"))
}

✅ Use try() for safe access to potentially null values

# Good
locals {
  container_memory = try(var.container_definitions[0].memory, 512)
}

✅ Use can() for validation

# Good validation
validation {
  condition     = can(regex("^[a-z0-9-]+$", var.name))
  error_message = "Name must contain only lowercase letters, numbers, and hyphens."
}

✅ Use one() for count-based resources

# Good
output "bucket_id" {
  value = try(one(aws_s3_bucket.optional).id, null)
}

✅ Test functions in terraform console before using

Don'ts

❌ Don't use uuid() or timestamp() without lifecycle ignore_changes

# Bad - causes perpetual diff
resource "random_id" "example" {
  keepers = {
    timestamp = timestamp()  # Changes every run!
  }
}

# Good - use plantimestamp() or ignore_changes
resource "random_id" "example" {
  keepers = {
    timestamp = plantimestamp()  # Consistent during plan
  }
}

❌ Don't over-nest function calls - use locals for clarity

# Bad - hard to read
resource "aws_s3_bucket" "example" {
  bucket = lower(replace(trimspace(var.name), "_", "-"))
}

# Good - clear steps
locals {
  cleaned_name     = trimspace(var.name)
  normalized_name  = replace(local.cleaned_name, "_", "-")
  bucket_name      = lower(local.normalized_name)
}

resource "aws_s3_bucket" "example" {
  bucket = local.bucket_name
}

❌ Don't use file() for large files - consider alternatives

# Bad for large files
locals {
  large_config = jsondecode(file("large-config.json"))
}

# Consider: use data sources or external systems for large configs

❌ Don't use deprecated functions (list(), map())

# Bad - deprecated
locals {
  items = list("a", "b", "c")
  config = map("key", "value")
}

# Good - use literal syntax
locals {
  items = ["a", "b", "c"]
  config = { key = "value" }
}

Quick Reference Summary

Total Functions: 100+ built-in functions

Categories:

• •Numeric (10) - Math operations
• •String (23) - Text manipulation
• •Collection (30) - Lists, maps, sets
• •Encoding (11) - JSON, YAML, CSV, Base64
• •Filesystem (15) - Files and paths
• •Date/Time (5) - Timestamps and formatting
• •Hash/Crypto (10) - Hashing and encryption
• •IP Network (4) - CIDR calculations
• •Type Conversion (9) - Type conversions
• •Validation (6) - Testing and validation
• •Provider (4) - Terraform provider functions

Most Commonly Used:

• •try() - Safe value access
• •merge() - Merge maps
• •concat() - Combine lists
• •length() - Get collection size
• •lookup() - Map value with default
• •jsondecode() / jsonencode() - JSON handling
• •file() - Read files
• •templatefile() - Template rendering
• •cidrsubnet() - Subnet calculations
• •one() - Extract single element

Documentation: https://developer.hashicorp.com/terraform/language/functions