Skip to main content

​
Literals

​
Strings

"hello world"
"line one\nline two"
Plain double-quoted strings. Standard escape sequences apply.

​
F-strings (interpolated strings)

f"vpc-{input.env}-{input.region}"
f"arn:aws:s3:::{input.bucket_name}"
Use f"..." with {expr} for interpolation. Double braces {{ and }} produce literal { and }.

​
Heredocs

policy = <<EOT
{
  "Version": "2012-10-17",
  "Statement": []
}
EOT
<<EOT preserves indentation. <<-EOT strips leading indentation from every line: 
policy = <<-EOT
    {
        "Statement": []
    }
    EOT
F-heredocs support interpolation: 
policy = f<<-EOT
    {
        "Resource": "{input.bucket_arn}/*"
    }
    EOT

​
Numbers

42
3.14
Integer and float literals are both TokenNumber. The declared type in input determines how the value is parsed.

​
Booleans

true
false

​
Null

null

​
Lists

["us-east-1a", "us-east-1b", "us-east-1c"]
[1, 2, 3]

​
Objects

{
    Name        = "my-vpc"
    Environment = input.env
}
Object literal fields use = (not :).

​
Reference expressions

​
Bare identifier

A bare name resolves to a resource binding or module name in the current stack: 
vpc.id       // vpc is a resource binding → Pending<T>
my_module.x  // my_module is a module → Pending<T>

​
Qualified input reference

input.vpc_cidr           // shorthand: looks up vpc_cidr across all input blocks
input.networking.vpc_cidr // explicit: block "networking", field "vpc_cidr"

​
Qualified locals reference

locals.nat_tier           // shorthand: looks up nat_tier across all locals blocks
locals.computed.nat_tier  // explicit: block "computed", field "nat_tier"

​
Member access (dot)

vpc.id
public_subnets.availability_zone
eks.endpoint

​
Index access

input.azs[0]
input.configs["prod"]
collection[*]        // splat — all elements

​
Cross-stack reference

@networking.vpc_id
@networking.subnet_ids
References an output exported by a sibling stack. The sibling must be in a directory adjacent to the current stack’s parent directory (same-parent rule). See Multi-stack workspaces. Validation errors:
  • stack "networking" not found — expected a sibling directory named "networking"
  • "endpoint" is not an output of stack "networking" — declared outputs are: [vpc_id, subnet_ids]

​
Arithmetic operators

OperatorExample
+input.count + 1
-input.max - input.min
*input.size * 1024
/input.total / 2
%input.count % 3

​
Comparison operators

OperatorExample
==input.env == "prod"
!=input.env != "test"
<input.count < 10
>input.count > 0
<=input.size <= 100
>=input.version >= 2

​
Logical operators

input.enabled && !input.disabled
input.is_prod || input.is_staging

​
Null coalescing

input.name ?? "default-name"
Returns the left operand if it is not null, otherwise the right operand.

​
Ternary expression

value if condition else fallback

"public-read" if input.is_public else "private"
Chained: 
"large" if input.size > 100 else "medium" if input.size > 10 else "small"
Ternary expressions are not allowed in resource properties. Move them to a locals block.

​
Match expression

match subject {
    "prod":    "t3.xlarge"
    "staging": "t3.medium"
    default:   "t3.micro"
}

locals "s" {
    instance_type = match input.env {
        "prod":    "t3.xlarge"
        "staging": "t3.medium"
        default:   "t3.micro"
    }
}
The default arm is optional but recommended. Arms are evaluated in order; the first match wins. Generated Python uses nested ternaries. Match expressions are not allowed in resource properties. Move them to a locals block.

​
Unary expressions

!input.enabled
-input.offset

​
Function calls

len(input.azs)
join(",", input.values)
upper(input.name)
See Built-in functions for the available functions.