Splat expressions in Terraform - Deep Dive

Overview - Splat expressions

What is it?

Splat expressions in Terraform let you easily extract or transform multiple values from a list or map of resources or objects. They use a special syntax with an asterisk (*) to apply an operation to each item in a collection. This helps you avoid writing repetitive code when working with many similar resources.

Why it matters

Without splat expressions, you would have to manually write code for each resource or use complex loops, making your Terraform files longer and harder to maintain. Splat expressions simplify this by letting you work with many resources at once, saving time and reducing errors. This makes managing cloud infrastructure more efficient and less error-prone.

Where it fits

Before learning splat expressions, you should understand basic Terraform resource definitions and how lists and maps work. After mastering splat expressions, you can explore advanced Terraform features like for_each, dynamic blocks, and modules to build scalable infrastructure.

Mental Model

Core Idea

Splat expressions let you pick or transform a specific part from every item in a list or map with a simple, repeatable pattern.

Think of it like...

Imagine you have a basket of apples and oranges, and you want to peel every apple quickly. Instead of peeling each one by hand, you use a machine that peels all apples at once. Splat expressions are like that machine for your code—they apply the same action to every item in a group automatically.

Resources List
┌───────────────┐
│ resource[0]   │
│ resource[1]   │
│ resource[2]   │
└─────┬─────────┘
      │
      ▼
Splat Expression: resource[*].attribute
      │
      ▼
Extracted List
┌───────────────┐
│ attribute[0]  │
│ attribute[1]  │
│ attribute[2]  │
└───────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Terraform Lists and Attributes

Concept: Learn what lists and attributes are in Terraform resources.

In Terraform, resources can be created multiple times using count or for_each, resulting in a list of resource instances. Each resource has attributes like name, id, or IP address. For example, if you create three servers, you get a list of three server objects, each with its own attributes.

Result

You understand that multiple resources form a list, and each has attributes you might want to access.

Knowing that resources can be grouped as lists with attributes is the base for using splat expressions to access those attributes efficiently.

2

Foundation

Basic Access to Resource Attributes

Concept: Learn how to access attributes of a single resource instance.

To get an attribute from one resource, you write resource_name[index].attribute. For example, aws_instance.web[0].id gets the id of the first web server. This works but becomes repetitive if you want the same attribute from many instances.

Result

You can get specific attributes from individual resources but see the need for a simpler way when dealing with many.

Understanding single attribute access highlights the problem splat expressions solve: repetitive code for multiple resources.

3

Intermediate

Using Splat Expressions for Simple Extraction

🤔Before reading on: do you think splat expressions return a list or a single value when applied to multiple resources? Commit to your answer.

Concept: Splat expressions let you extract the same attribute from all resources in a list at once.

Instead of writing aws_instance.web[0].id, aws_instance.web[1].id, and so on, you write aws_instance.web[*].id. This returns a list of all ids from the web instances. The * means 'for each item in the list, get this attribute.'

Result

You get a list of attribute values from all resource instances in one expression.

Knowing that splat expressions return lists of attributes simplifies working with multiple resources and reduces code duplication.

4

Intermediate

Splat Expressions with Nested Attributes

🤔Before reading on: do you think splat expressions can access nested attributes inside complex objects? Commit to your answer.

Concept: Splat expressions can access attributes inside nested objects or maps within resources.

If a resource attribute is itself an object or map, you can chain splat expressions or dot notation. For example, aws_instance.web[*].network_interface[0].private_ip extracts the private IP from the first network interface of each instance.

Result

You can extract deeply nested information from multiple resources easily.

Understanding nested access with splat expressions unlocks powerful data extraction from complex resource structures.

5

Intermediate

Difference Between Simple and Full Splat Expressions

🤔Before reading on: do you think resource[*] and resource[*].attribute behave the same? Commit to your answer.

Concept: Terraform has two splat forms: simple (resource[*]) returns full objects; full (resource[*].attribute) returns specific attributes.

resource[*] returns a list of full resource objects, useful when you want to pass entire resources. resource[*].attribute returns a list of specific attribute values. Knowing when to use each is important.

Result

You can choose to get full resource objects or just attributes depending on your need.

Knowing the difference prevents confusion and errors when passing data between resources or modules.

6

Advanced

Combining Splat Expressions with For Expressions

🤔Before reading on: do you think splat expressions can replace for expressions completely? Commit to your answer.

Concept: Splat expressions are simpler but less flexible than for expressions, which allow filtering and transformations.

For example, to get only private IPs of instances with a tag, you use for expressions with if conditions. Splat expressions cannot filter or transform data beyond simple extraction.

Result

You understand when to use splat expressions for simple extraction and when to use for expressions for complex logic.

Knowing splat expressions' limits helps you pick the right tool for data extraction and transformation in Terraform.

7

Expert

Splat Expressions in Complex Module Outputs

🤔Before reading on: do you think splat expressions can be used to flatten nested lists from modules? Commit to your answer.

Concept: Splat expressions can be combined with flatten and other functions to handle nested lists from modules or resources.

When a module outputs a list of lists, you can use flatten(module.example[*].output) to get a single list. This is useful in large infrastructures where modules return complex nested data.

Result

You can efficiently handle and simplify complex nested outputs using splat expressions combined with functions.

Understanding this advanced use enables managing large-scale Terraform projects with modular and nested data.

Under the Hood

Terraform parses splat expressions during plan and apply phases by iterating over the resource instances list and extracting the requested attribute from each. It builds a new list with these values, which can then be used in other parts of the configuration. This iteration is done internally without explicit loops in the code, making the syntax concise.

Why designed this way?

Splat expressions were designed to simplify repetitive attribute access across multiple resources, reducing boilerplate and improving readability. Before splat expressions, users had to manually write out each index or use complex workarounds. The design balances simplicity and power, avoiding the complexity of full loops while covering common use cases.

Terraform Configuration
┌─────────────────────────────┐
│ resource "aws_instance" "web" {  │
│   count = 3                 │
│   ...                      │
└─────────────┬───────────────┘
              │
              ▼
Resource Instances List
┌───────────────┐
│ web[0]        │
│ web[1]        │
│ web[2]        │
└─────┬─────────┘
      │
      ▼
Splat Expression Parsing
┌─────────────────────────────┐
│ aws_instance.web[*].id      │
│  └─ Iterates over web list  │
│  └─ Extracts id attribute    │
└─────────────┬───────────────┘
              │
              ▼
Resulting List of IDs
┌───────────────┐
│ id[0]         │
│ id[1]         │
│ id[2]         │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: does resource[*].attribute return a single value or a list? Commit to your answer.

Common Belief: resource[*].attribute returns a single attribute value from the first resource only.

Reality: resource[*].attribute returns a list of attribute values from all resources in the list.

Why it matters: Assuming it returns a single value leads to errors when using the output, causing Terraform to fail or behave unexpectedly.

Quick: can splat expressions filter or transform data beyond simple extraction? Commit to your answer.

Common Belief: Splat expressions can filter or modify the list items like loops with conditions.

Reality: Splat expressions only extract attributes; they cannot filter or transform data. For that, you need for expressions.

Why it matters: Misusing splat expressions for filtering causes confusion and incorrect configurations, leading to bugs.

Quick: does resource[*] return a list of attribute values or full resource objects? Commit to your answer.

Common Belief: resource[*] returns a list of attribute values like resource[*].attribute does.

Reality: resource[*] returns a list of full resource objects, not just attributes.

Why it matters: Confusing these leads to wrong data types being passed around, causing errors in Terraform plans.

Quick: can splat expressions flatten nested lists automatically? Commit to your answer.

Common Belief: Splat expressions automatically flatten nested lists when extracting attributes.

Reality: Splat expressions do not flatten nested lists; you must use the flatten function explicitly.

Why it matters: Expecting automatic flattening causes unexpected nested structures and errors in resource references.

Expert Zone

1

Splat expressions evaluate lazily during Terraform's plan phase, so changes in resource count or attributes dynamically update the extracted lists.

2

Using splat expressions with resources created by for_each requires understanding that the order is not guaranteed, unlike count-based resources.

3

Combining splat expressions with functions like flatten or distinct allows powerful data manipulation but requires careful type handling to avoid errors.

When NOT to use

Avoid splat expressions when you need to filter, transform, or conditionally select items; use for expressions instead. Also, for resources created with for_each, prefer for expressions for predictable ordering and key-based access.

Production Patterns

In production, splat expressions are commonly used to gather IDs, IPs, or names from multiple instances for use in security groups, load balancers, or outputs. They simplify passing lists of resource attributes between modules and reduce code duplication.

Connections

List Comprehensions (Programming)

Splat expressions are similar to list comprehensions as both extract or transform lists in a concise way.

Understanding splat expressions helps grasp list comprehensions in programming languages, showing how to work with collections efficiently.

Batch Processing (Operations)

Both splat expressions and batch processing apply the same operation to many items at once.

Recognizing this pattern across domains helps understand why bulk operations improve efficiency and reduce repetitive work.

Map Function (Functional Programming)

Splat expressions behave like a map function that applies a function to each item in a list.

Knowing this connection clarifies the functional nature of splat expressions and their role in transforming data collections.

Common Pitfalls

#1 Trying to access an attribute without using splat on multiple resources.

Wrong approach:

aws_instance.web.id

Correct approach:

aws_instance.web[*].id

Root cause:

For multiple resources, you must specify which instance or use splat to get all; missing this causes errors.

#2 Using splat expressions to filter resources by condition.

Wrong approach:

aws_instance.web[*].id if aws_instance.web[*].tags.Name == "prod"

Correct approach:

[for inst in aws_instance.web : inst.id if inst.tags.Name == "prod"]

Root cause:

Splat expressions do not support filtering; for expressions are needed for conditional selection.

#3 Assuming splat expressions flatten nested lists automatically.

Wrong approach:

flattened = aws_instance.web[*].network_interface[*].private_ip

Correct approach:

flattened = flatten([for inst in aws_instance.web : inst.network_interface[*].private_ip])

Root cause:

Splat expressions return nested lists if attributes are lists; flatten must be used explicitly.

Key Takeaways

Splat expressions let you extract the same attribute from all items in a list of resources with simple syntax.

They return lists of values, making it easy to work with multiple resource attributes at once.

Splat expressions cannot filter or transform data; for expressions are needed for those tasks.

Understanding the difference between simple and full splat expressions prevents common errors.

Combining splat expressions with functions like flatten enables handling complex nested data in Terraform.