Terraform Functions: Complete Reference with Practical Examples

Terraform does more than just provision infrastructure. It gives you a powerful set of built-in functions you can use inside your configuration to transform data, format strings, loop over collections, encode values, and much more.

If you have ever written Terraform and found yourself repeating values, hard-coding logic, or wishing you could manipulate a list before passing it to a resource — functions are the answer.

This guide covers every major category of Terraform functions, with real examples you can drop straight into your codebase.

What Are Terraform Functions?

Terraform functions are built-in expressions you can call inside your .tf files to compute or transform values. They are similar to functions in any programming language — you pass in one or more arguments, and they return a result.

You use them inside ${} expressions or directly in resource arguments. Here is a simple example using the upper function:

variable "env" {
  default = "production"
}

output "env_label" {
  value = upper(var.env)  # Returns "PRODUCTION"
}

  

Terraform functions are evaluated at plan time, not at runtime. That means the result is computed before any infrastructure is created — making your configurations predictable and safe to review.

String Functions

String functions let you manipulate, format, and transform text values. These are among the most commonly used functions in real Terraform configurations.

Practical String Example: Building Consistent Resource Names

One of the most common uses of string functions is building standardised resource names from input variables:

variable "project" { default = "payments" }
variable "env"     { default = "prod" }
variable "region"  { default = "us-east-1" }

locals {
  name_prefix = lower(format("%s-%s-%s", var.project, var.env, var.region))
  # Result: "payments-prod-us-east-1"
}

resource "aws_s3_bucket" "data" {
  bucket = "${local.name_prefix}-data"
  # Result: "payments-prod-us-east-1-data"
}

  

Numeric Functions

Numeric functions let you perform arithmetic operations and comparisons on number values.

Practical Numeric Example: Calculating Instance Counts

variable "team_size" { default = 12 }
 
locals {
  # Always round up so no team member is left without a node
  node_count = ceil(var.team_size / 4)
  # Result: 3
}
 
resource "aws_instance" "worker" {
  count = local.node_count
  # ...
}

  

Collection Functions

Collection functions are some of the most powerful in Terraform. They let you work with lists, maps, and sets — filtering, merging, transforming, and inspecting them.

Practical Collection Example: Merging Environment Tags

A very common pattern is merging a base set of tags with environment-specific ones:

locals {
  base_tags = {
    managed_by = "terraform"
    team       = "platform"
  }

  env_tags = {
    environment = var.env
    cost_centre = var.cost_centre
  }

  all_tags = merge(local.base_tags, local.env_tags)
}
 
resource "aws_instance" "app" {
  # ...
  tags = local.all_tags
}

  

Date and Time Functions

Terraform includes a small set of functions for working with timestamps — useful for generating unique resource names, setting expiry values, or tagging resources with creation dates.

Practical Date Example: Tagging Resources with a Creation Date

locals {
  created_date = formatdate("YYYY-MM-DD", timestamp())
}
 
resource "aws_s3_bucket" "archive" {
  bucket = "logs-archive-${local.created_date}"
  tags = {
    created_on = local.created_date
  }
}

  

Encoding Functions

Encoding functions let you convert data between different formats — essential when you need to pass structured data as strings, or work with base64-encoded secrets and certificates.

Practical Encoding Example: Passing a JSON Policy to AWS IAM

locals {
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = "arn:aws:s3:::my-bucket/*"
    }]
  })
}
 
resource "aws_iam_role_policy" "s3_read" {
  name   = "s3-read-policy"
  role   = aws_iam_role.app.id
  policy = local.policy
}

  

Filesystem Functions

Filesystem functions let you read files from your local disk into your Terraform configuration. This is useful for loading scripts, certificates, policies, and other external content.

Practical Filesystem Example: Loading User Data from a Template

# user_data.tpl
#!/bin/bash
echo "Environment: ${environment}"
echo "Region: ${region}"
apt-get update && apt-get install -y ${package}
 
# main.tf
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
 
  user_data = templatefile("user_data.tpl", {
    environment = var.env
    region      = var.region
    package     = "nginx"
  })
}

  

Type Conversion Functions

Terraform is a strongly typed language. Sometimes you need to convert a value from one type to another — for example, converting a number to a string so it can be used in a resource name, or converting a list to a set to remove duplicates.

Practical Type Conversion Example: Safe Optional Variable Lookup

The try function is especially useful when working with optional or nested variables that might not always be set:

variable "config" {
  type    = any
  default = {}
}
 
locals {
  # Safely retrieve nested values with a fallback
  log_level    = try(var.config.logging.level, "info")
  max_replicas = try(tonumber(var.config.replicas.max), 5)
}

  

Hash and Crypto Functions

Hash functions generate a fixed-length fingerprint of a value. They are often used to generate unique identifiers, detect changes, or create deterministic resource names based on content.

Practical Hash Example: Triggering Lambda Redeployment on Code Change

A very common pattern is using filesha256 to force a Lambda function to redeploy only when its deployment package actually changes:

resource "aws_lambda_function" "api" {
  function_name = "my-api"
  filename      = "lambda.zip"
 
  # Only redeploy when the zip file content changes
  source_code_hash = filesha256("lambda.zip")
 
  runtime = "python3.11"
  handler = "main.handler"
  role    = aws_iam_role.lambda.arn
}

  

IP Network Functions

IP network functions help you work with CIDR blocks — splitting them, calculating subnet addresses, and checking whether an IP falls within a range. These are invaluable for networking configurations.

Practical IP Example: Generating Subnets Dynamically for a VPC

variable "vpc_cidr" { default = "10.0.0.0/16" }
 
locals {
  # Automatically slice the VPC CIDR into 3 equal /24 subnets
  subnet_cidrs = cidrsubnets(var.vpc_cidr, 8, 8, 8)
  # Result: ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
}
 
resource "aws_subnet" "public" {
  count             = length(local.subnet_cidrs)
  vpc_id            = aws_vpc.main.id
  cidr_block        = local.subnet_cidrs[count.index]
  availability_zone = data.aws_availability_zones.available.names[count.index]
}

  

How env zero Helps You Get More From Terraform Functions

Terraform functions are powerful on their own — but they become even more valuable when your entire team is using them consistently, inside approved module patterns, with policy guardrails that catch misuse before it reaches production.

env zero gives platform and cloud teams the layer of governance that Terraform does not ship with:

• Standardised modules — reusable patterns that already use the right functions for naming, tagging, and networking, so every team starts from a solid baseline.
• Policy enforcement — automated checks that validate resource naming conventions, required tags, and CIDR configurations before a terraform apply is allowed to run.
• Drift detection — if someone bypasses Terraform and makes a manual change, env zero flags the drift immediately so your functions-generated names and tags stay the source of truth.
• Cost visibility — tags generated using merge, format, and lower feed directly into env zero's cost attribution dashboards, so you can see spending by team, project, and environment without any extra work.

Whether you are just starting with Terraform functions or building a mature, multi-team IaC platform, env zero is designed to help you scale confidently.

Frequently Asked Questions

Can I define my own functions in Terraform?

No — Terraform does not currently support user-defined functions. You work with the built-in library. However, you can achieve similar reuse through locals (for computed values), modules (for reusable patterns), and expressions. The Terraform team has discussed custom functions as a future feature, and OpenTofu has begun exploring this capability.

Where can I use functions in Terraform?

Functions can be used anywhere Terraform evaluates an expression — inside resource arguments, variable defaults, locals, outputs, and data source arguments. They cannot be used in the terraform block itself (for backend configuration), as that block is evaluated before variables are available.

What is the difference between locals and functions?

Functions are built-in operations that transform a value — like upper() converting a string to uppercase. Locals are named values you define yourself, which can call functions. You typically combine them: use a function inside a local to compute a reusable value once, then reference the local throughout your configuration.

Are Terraform functions the same in OpenTofu?

Yes — OpenTofu is a fork of Terraform and supports the same built-in function library. OpenTofu 1.7 and later also added provider-defined functions, which allow Terraform providers to ship their own custom functions. This is a capability that does not yet exist in Terraform itself.

How do I debug a Terraform function call?

The easiest way is to use a terraform console session. Run terraform console in your working directory and type function calls interactively to see their output immediately. It is the fastest way to test expressions without running a full plan.