Terraform: Infrastructure as Code Mastery

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

┌─────────────────────────────────────────────────────────────────────────────┐
│                            TERRAFORM ARCHITECTURE                           │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│   ┌─────────────────┐        ┌──────────────────────────────────────────┐  │
│   │   Configuration │        │           TERRAFORM CORE                 │  │
│   │   Files (.tf)   │───────▶│                                          │  │
│   └─────────────────┘        │  ┌─────────────────────────────────────┐ │  │
│                              │  │        Configuration Parser          │ │  │
│   ┌─────────────────┐        │  │  (HCL/JSON → Internal Graph Model)  │ │  │
│   │   State File    │◀──────▶│  └─────────────────────────────────────┘ │  │
│   │  (terraform.    │        │                    │                     │  │
│   │   tfstate)      │        │                    ▼                     │  │
│   └─────────────────┘        │  ┌─────────────────────────────────────┐ │  │
│                              │  │         Dependency Graph             │ │  │
│                              │  │   (Resource ordering & parallelism)  │ │  │
│                              │  └─────────────────────────────────────┘ │  │
│                              │                    │                     │  │
│                              │                    ▼                     │  │
│                              │  ┌─────────────────────────────────────┐ │  │
│                              │  │          Plan Engine                 │ │  │
│                              │  │    (Diff calculation & ordering)     │ │  │
│                              │  └─────────────────────────────────────┘ │  │
│                              │                    │                     │  │
│                              └────────────────────│─────────────────────┘  │
│                                                   │                        │
│                                                   ▼                        │
│   ┌─────────────────────────────────────────────────────────────────────┐  │
│   │                          PROVIDER LAYER                             │  │
│   ├─────────────────┬─────────────────┬─────────────────┬──────────────┤  │
│   │   AWS Provider  │  Azure Provider │   GCP Provider  │  Kubernetes  │  │
│   │                 │                 │                 │   Provider   │  │
│   │  ┌───────────┐  │  ┌───────────┐  │  ┌───────────┐  │ ┌──────────┐ │  │
│   │  │ Resources │  │  │ Resources │  │  │ Resources │  │ │Resources │ │  │
│   │  │ - ec2     │  │  │ - vm      │  │  │ - compute │  │ │- pod     │ │  │
│   │  │ - s3      │  │  │ - storage │  │  │ - storage │  │ │- deploy  │ │  │
│   │  │ - vpc     │  │  │ - vnet    │  │  │ - network │  │ │- svc     │ │  │
│   │  └───────────┘  │  └───────────┘  │  └───────────┘  │ └──────────┘ │  │
│   └─────────────────┴─────────────────┴─────────────────┴──────────────┘  │
│                                       │                                    │
│                                       ▼                                    │
│   ┌─────────────────────────────────────────────────────────────────────┐  │
│   │                     ACTUAL CLOUD INFRASTRUCTURE                     │  │
│   │        (AWS, Azure, GCP, Kubernetes, Datadog, GitHub, etc.)         │  │
│   └─────────────────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161

# HCL Syntax Fundamentals
# This file demonstrates core HCL concepts
 
# ==============================================================================
# BLOCKS: The primary structural element
# ==============================================================================
 
# A block has a TYPE, optional LABELS, and a BODY containing ARGUMENTS
# Format: <block_type> "<label1>" "<label2>" { ... }
 
terraform {
  # The terraform block configures Terraform itself
  required_version = ">= 1.0.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  
  # Backend configuration for remote state storage
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}
 
# Provider block: Configures the provider plugin
provider "aws" {
  region = "us-west-2"
  
  default_tags {
    tags = {
      Environment = "production"
      ManagedBy   = "terraform"
    }
  }
}
 
# ==============================================================================
# RESOURCES: Concrete infrastructure objects
# ==============================================================================
 
# Resource block: <resource_type> "<local_name>"
resource "aws_vpc" "main" {
  # ARGUMENTS: key-value pairs
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "main-vpc"
    Tier = "networking"
  }
}
 
# Resource with reference to another resource
resource "aws_subnet" "public" {
  # Reference another resource using <resource_type>.<local_name>.<attribute>
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-west-2a"
  map_public_ip_on_launch = true
  
  tags = {
    Name = "public-subnet"
    Type = "public"
  }
}
 
# ==============================================================================
# VARIABLES: Input parameters for configuration
# ==============================================================================
 
variable "environment" {
  description = "Deployment environment (dev, staging, production)"
  type        = string
  default     = "development"
  
  validation {
    condition     = contains(["development", "staging", "production"], var.environment)
    error_message = "Environment must be development, staging, or production."
  }
}
 
variable "instance_count" {
  description = "Number of EC2 instances to create"
  type        = number
  default     = 2
  
  validation {
    condition     = var.instance_count > 0 && var.instance_count <= 10
    error_message = "Instance count must be between 1 and 10."
  }
}
 
# Complex variable types
variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
  default     = ["us-west-2a", "us-west-2b", "us-west-2c"]
}
 
variable "instance_config" {
  description = "Configuration for EC2 instances"
  type = object({
    instance_type = string
    volume_size   = number
    encrypted     = bool
  })
  default = {
    instance_type = "t3.micro"
    volume_size   = 20
    encrypted     = true
  }
}
 
# ==============================================================================
# LOCALS: Computed values for use within the module
# ==============================================================================
 
locals {
  # Simple computed values
  name_prefix = "${var.environment}-app"
  
  # Complex expressions
  common_tags = {
    Environment = var.environment
    Project     = "infrastructure"
    ManagedBy   = "terraform"
    UpdatedAt   = timestamp()
  }
  
  # Conditional logic
  is_production = var.environment == "production"
  
  # Computed from other resources
  vpc_cidr_blocks = [aws_vpc.main.cidr_block]
}
 
# ==============================================================================
# OUTPUTS: Values exposed after apply
# ==============================================================================
 
output "vpc_id" {
  description = "The ID of the created VPC"
  value       = aws_vpc.main.id
}
 
output "vpc_arn" {
  description = "The ARN of the created VPC"
  value       = aws_vpc.main.arn
  sensitive   = false
}
 
output "subnet_ids" {
  description = "List of subnet IDs"
  value       = [aws_subnet.public.id]
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

┌─────────────────────────────────────────────────────────────────────────────┐
│                         TERRAFORM WORKFLOW                                  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│   PHASE 1: WRITE                                                            │
│   ─────────────────                                                         │
│   ┌───────────────────────────────────────────────────────────────────┐    │
│   │  • Author .tf configuration files                                 │    │
│   │  • Define providers, resources, variables, outputs                │    │
│   │  • Store in version control (Git)                                 │    │
│   │  • Peer review changes via pull requests                          │    │
│   └───────────────────────────────────────────────────────────────────┘    │
│                                │                                            │
│                                ▼                                            │
│   PHASE 2: INIT                                                             │
│   ─────────────────                                                         │
│   ┌───────────────────────────────────────────────────────────────────┐    │
│   │  $ terraform init                                                 │    │
│   │                                                                   │    │
│   │  • Download required provider plugins                             │    │
│   │  • Initialize backend for state storage                           │    │
│   │  • Create .terraform directory with cached plugins                │    │
│   │  • Generate .terraform.lock.hcl for reproducible versions         │    │
│   └───────────────────────────────────────────────────────────────────┘    │
│                                │                                            │
│                                ▼                                            │
│   PHASE 3: PLAN                                                             │
│   ─────────────────                                                         │
│   ┌───────────────────────────────────────────────────────────────────┐    │
│   │  $ terraform plan                                                 │    │
│   │                                                                   │    │
│   │  • Read current state from state file/backend                     │    │
│   │  • Query providers for actual resource state                      │    │
│   │  • Compare desired (config) vs actual (current) state             │    │
│   │  • Generate execution plan showing all changes                    │    │
│   │  • Display: + create, ~ update, - destroy, -/+ replace            │    │
│   │  • NOTHING IS CHANGED - this is read-only                         │    │
│   └───────────────────────────────────────────────────────────────────┘    │
│                                │                                            │
│                                ▼                                            │
│   PHASE 4: APPLY                                                            │
│   ─────────────────                                                         │
│   ┌───────────────────────────────────────────────────────────────────┐    │
│   │  $ terraform apply                                                │    │
│   │                                                                   │    │
│   │  • Review plan output (same as terraform plan)                    │    │
│   │  • Prompt for approval (yes/no) unless -auto-approve              │    │
│   │  • Execute changes in dependency order                            │    │
│   │  • Update state file with new resource attributes                 │    │
│   │  • Show outputs after successful completion                       │    │
│   └───────────────────────────────────────────────────────────────────┘    │
│                                │                                            │
│                                ▼                                            │
│   PHASE 5: DESTROY (when needed)                                            │
│   ─────────────────                                                         │
│   ┌───────────────────────────────────────────────────────────────────┐    │
│   │  $ terraform destroy                                              │    │
│   │                                                                   │    │
│   │  • Generate destruction plan for ALL resources                    │    │
│   │  • Prompt for approval                                            │    │
│   │  • Delete resources in reverse dependency order                   │    │
│   │  • Clear state file                                               │    │
│   └───────────────────────────────────────────────────────────────────┘    │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

$ terraform plan
 
Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy
  -/+ destroy and then create replacement
 
Terraform will perform the following actions:
 
  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami                          = "ami-0c55b159cbfafe1f0"
      + arn                          = (known after apply)
      + associate_public_ip_address  = true
      + availability_zone            = (known after apply)
      + cpu_core_count               = (known after apply)
      + id                           = (known after apply)
      + instance_state               = (known after apply)
      + instance_type                = "t3.micro"
      + private_ip                   = (known after apply)
      + public_ip                    = (known after apply)
      + subnet_id                    = "subnet-abc123"
      + tags                         = {
          + "Environment" = "production"
          + "Name"        = "web-server"
        }
      + vpc_security_group_ids       = (known after apply)
      
      + root_block_device {
          + delete_on_termination = true
          + encrypted             = true
          + volume_size           = 20
          + volume_type           = "gp3"
        }
    }
 
  # aws_security_group.web will be updated in-place
  ~ resource "aws_security_group" "web" {
        id          = "sg-xyz789"
        name        = "web-sg"
        tags        = {
            "Name" = "web-security-group"
        }
        
      ~ ingress {
          ~ cidr_blocks      = [
              - "0.0.0.0/0",
              + "10.0.0.0/8",
            ]
            from_port        = 443
            protocol         = "tcp"
            to_port          = 443
        }
    }
 
  # aws_instance.old will be destroyed
  # (because aws_instance.old is not in configuration)
  - resource "aws_instance" "old" {
      - ami                          = "ami-old-version" -> null
      - id                           = "i-abc123def456" -> null
      - instance_type                = "t2.micro" -> null
      - tags                         = {
          - "Name" = "old-server"
        } -> null
    }
 
Plan: 1 to add, 1 to change, 1 to destroy.
 
Changes to Outputs:
  + new_instance_ip = (known after apply)
  - old_instance_ip = "10.0.1.50" -> null

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

# Data Source: Read existing, externally-managed resources
# Terraform will QUERY this, not CREATE it
 
# Find the latest Ubuntu AMI
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]  # Canonical's AWS account ID
  
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
  
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}
 
# Read an existing VPC by tag
data "aws_vpc" "existing" {
  filter {
    name   = "tag:Name"
    values = ["production-vpc"]
  }
}
 
# Read AWS account details
data "aws_caller_identity" "current" {}
 
data "aws_region" "current" {}
 
# Use data sources in resources
resource "aws_instance" "web" {
  # Use the data source to get the AMI ID dynamically
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
  
  # Reference the existing VPC's ID
  subnet_id     = data.aws_vpc.existing.id
  
  tags = {
    Name    = "web-server"
    # Use data sources for metadata
    Account = data.aws_caller_identity.current.account_id
    Region  = data.aws_region.current.name
    AMI     = data.aws_ami.ubuntu.name
  }
}
 
output "ami_details" {
  value = {
    id           = data.aws_ami.ubuntu.id
    name         = data.aws_ami.ubuntu.name
    owner        = data.aws_ami.ubuntu.owner_id
    created_date = data.aws_ami.ubuntu.creation_date
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

# Implicit Dependencies (Recommended)
# Terraform automatically detects dependencies from references
 
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags       = { Name = "main-vpc" }
}
 
# This DEPENDS ON aws_vpc.main because it references aws_vpc.main.id
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id  # <-- Creates implicit dependency
  tags   = { Name = "main-igw" }
}
 
# This DEPENDS ON aws_vpc.main
resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id  # <-- Creates implicit dependency
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-west-2a"
  tags              = { Name = "public-subnet" }
}
 
# This DEPENDS ON both aws_subnet.public AND aws_internet_gateway.igw
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
 
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id  # <-- Creates dependency
  }
 
  tags = { Name = "public-rt" }
}
 
resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id     # <-- Depends on subnet
  route_table_id = aws_route_table.public.id  # <-- Depends on route table
}
 
# ==============================================================================
# Explicit Dependencies (Use sparingly)
# When there's a dependency Terraform can't automatically detect
# ==============================================================================
 
resource "aws_iam_role_policy_attachment" "lambda_logs" {
  role       = aws_iam_role.lambda.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
 
resource "aws_lambda_function" "example" {
  filename      = "lambda.zip"
  function_name = "example-function"
  role          = aws_iam_role.lambda.arn
  handler       = "index.handler"
  runtime       = "nodejs18.x"
  
  # Explicit dependency: ensure policy is attached before function creation
  # This is necessary because aws_lambda_function doesn't reference
  # aws_iam_role_policy_attachment directly, but needs the policy attached
  depends_on = [aws_iam_role_policy_attachment.lambda_logs]
}
 
# ==============================================================================
# Visualizing the Dependency Graph
# ==============================================================================
# Run: terraform graph | dot -Tpng > graph.png
#
# This generates a visual representation of all dependencies

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# The dependency graph for the above configuration:
 
                        ┌─────────────────┐
                        │   aws_vpc.main  │
                        └────────┬────────┘
                                 │
              ┌──────────────────┼──────────────────┐
              │                  │                  │
              ▼                  ▼                  │
┌─────────────────────┐  ┌─────────────────┐       │
│aws_internet_gateway │  │ aws_subnet.public│       │
│        .igw         │  └────────┬────────┘       │
└──────────┬──────────┘           │                │
           │                      │                │
           └───────────┬──────────┘                │
                       │                           │
                       ▼                           │
            ┌─────────────────────┐                │
            │aws_route_table.public│◀──────────────┘
            └──────────┬──────────┘
                       │
                       ▼
        ┌────────────────────────────┐
        │aws_route_table_association │
        │          .public           │
        └────────────────────────────┘
 
# Terraform processes this graph:
# 1. Creates aws_vpc.main first (no dependencies)
# 2. Creates aws_internet_gateway.igw AND aws_subnet.public IN PARALLEL
# 3. Creates aws_route_table.public (waits for IGW and VPC)
# 4. Creates aws_route_table_association.public (waits for subnet and RT)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185

# ==============================================================================
# OPERATORS AND EXPRESSIONS
# ==============================================================================
 
locals {
  # Arithmetic operators
  total_cpu    = var.cpu_per_node * var.node_count
  memory_ratio = var.memory_gb / var.cpu_count
  
  # Comparison operators (return boolean)
  is_large_cluster      = var.node_count > 10
  needs_high_availability = var.environment == "production"
  
  # Logical operators
  enable_monitoring = var.environment == "production" || var.enable_debug
  is_critical       = local.is_large_cluster && local.needs_high_availability
  disable_feature   = !var.feature_enabled
  
  # Conditional expressions (ternary)
  instance_type = var.environment == "production" ? "m5.xlarge" : "t3.micro"
  
  # Nested conditionals (use sparingly)
  storage_size = (
    var.environment == "production" ? 500 :
    var.environment == "staging" ? 100 :
    20  # default for development
  )
}
 
# ==============================================================================
# STRING FUNCTIONS
# ==============================================================================
 
locals {
  # String manipulation
  upper_env     = upper(var.environment)           # "PRODUCTION"
  lower_name    = lower(var.name)                  # "my-app"
  title_case    = title(var.name)                  # "My App"
  trimmed       = trimspace("  hello  ")           # "hello"
  
  # String formatting
  formatted_name = format("%s-%s-%03d", var.project, var.env, var.index) # "app-prod-001"
  
  # String interpolation (preferred over format for simple cases)
  resource_name = "${var.project}-${var.environment}-api"
  
  # Regular expressions
  is_valid_email = can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", var.email))
  
  # Join and split
  az_string     = join(",", var.availability_zones)               # "us-west-2a,us-west-2b"  
  az_list       = split(",", "us-west-2a,us-west-2b,us-west-2c") # ["us-west-2a", ...]
  
  # Replace
  sanitized_name = replace(var.name, "/[^a-zA-Z0-9]/", "-") # Replace special chars
}
 
# ==============================================================================
# COLLECTION FUNCTIONS
# ==============================================================================
 
variable "server_configs" {
  default = [
    { name = "web-1", role = "web", size = "small" },
    { name = "web-2", role = "web", size = "medium" },
    { name = "db-1",  role = "db",  size = "large" },
  ]
}
 
locals {
  # Length
  server_count = length(var.server_configs)  # 3
  
  # Element access
  first_server = var.server_configs[0]                    # { name = "web-1", ... }
  last_server  = element(var.server_configs, length(var.server_configs) - 1)
  
  # Lookup (for maps)
  regions_map = {
    "us" = "us-west-2"
    "eu" = "eu-west-1"
    "ap" = "ap-northeast-1"
  }
  selected_region = lookup(local.regions_map, var.region_code, "us-west-2")
  
  # Keys and values
  region_codes = keys(local.regions_map)    # ["us", "eu", "ap"]
  region_names = values(local.regions_map)  # ["us-west-2", "eu-west-1", ...]
  
  # Merge maps
  base_tags = { Environment = var.environment, ManagedBy = "terraform" }
  app_tags  = { Application = var.app_name, Team = var.team }
  all_tags  = merge(local.base_tags, local.app_tags)
  
  # Flatten nested lists
  nested_list  = [["a", "b"], ["c", "d"], ["e"]]
  flat_list    = flatten(local.nested_list)  # ["a", "b", "c", "d", "e"]
  
  # Distinct (remove duplicates)
  all_zones   = ["us-west-2a", "us-west-2b", "us-west-2a"]
  unique_zones = distinct(local.all_zones)  # ["us-west-2a", "us-west-2b"]
  
  # Coalesce (first non-null/empty value)
  actual_name = coalesce(var.custom_name, var.default_name, "unnamed")
  
  # Compact (remove null/empty from list)
  valid_items = compact([var.item1, var.item2, null, "", var.item3])
}
 
# ==============================================================================
# FOR EXPRESSIONS (List/Map Comprehensions)
# ==============================================================================
 
locals {
  # Transform list -> list
  server_names = [for s in var.server_configs : s.name]  # ["web-1", "web-2", "db-1"]
  
  # Transform with index
  indexed_names = [for i, s in var.server_configs : "${i}: ${s.name}"]
  
  # Filter with condition
  web_servers = [for s in var.server_configs : s if s.role == "web"]
  
  # Transform list -> map
  servers_by_name = { for s in var.server_configs : s.name => s }
  # Result: { "web-1" = {...}, "web-2" = {...}, "db-1" = {...} }
  
  # Map transformation
  size_lookup = { for s in var.server_configs : s.name => s.size }
  # Result: { "web-1" = "small", "web-2" = "medium", "db-1" = "large" }
  
  # Uppercase all keys
  upper_regions = { for k, v in local.regions_map : upper(k) => v }
}
 
# ==============================================================================
# TYPE CONVERSION FUNCTIONS
# ==============================================================================
 
locals {
  # Convert to different types
  count_string = tostring(var.instance_count)          # "3"
  count_number = tonumber(var.count_string)            # 3
  enabled_bool = tobool(var.enabled_string)            # true
  
  # Convert collections
  az_set    = toset(var.availability_zones)            # Set (unique values)
  az_list   = tolist(local.az_set)                     # List
  config_map = tomap(var.config_object)                # Map
  
  # JSON encoding/decoding
  json_string = jsonencode({ name = "app", version = "1.0" })
  json_object = jsondecode(file("config.json"))
  
  # YAML encoding/decoding
  yaml_string = yamlencode({ name = "app", version = "1.0" })
  yaml_object = yamldecode(file("config.yaml"))
}
 
# ==============================================================================
# FILE FUNCTIONS
# ==============================================================================
 
locals {
  # Read file contents
  user_data_script = file("${path.module}/scripts/user-data.sh")
  
  # Read and base64 encode (common for user data)
  encoded_script = base64encode(file("${path.module}/scripts/bootstrap.sh"))
  
  # Template file (with variable substitution)
  # Deprecated: use templatefile() instead
  
  # Use templatefile for dynamic content
  rendered_config = templatefile("${path.module}/templates/config.tpl", {
    db_host     = aws_db_instance.main.endpoint
    db_port     = aws_db_instance.main.port
    environment = var.environment
  })
  
  # Path references
  module_path = path.module    # Directory containing current .tf file
  root_path   = path.root      # Root module directory
  cwd_path    = path.cwd       # Current working directory
}