Using Terraform Splat Expressions Correctly: Master Bulk Attribute Access

A splat expression is Terraform syntax for pulling a specific attribute out of every element of a list or other collection at once. The typical use case is bulk-fetching IDs from multiple instances, e.g., aws_instance.web[*].id.

Since Terraform 0.12, the recommended approach is full splat ([*]) plus for expressions rather than legacy splat (.*.). This article sticks to stable behavior and covers both the implementation and exam angles based on the official documentation.

Splat Basics: full splat ([*]) and legacy (.*.)

Splat expressions extract per-element attribute values from indexable collections (mainly lists/tuples, sets, and map/objects converted to values). The classic case is pulling attributes out of resources or modules created with count or for_each.

Since Terraform 0.12, full splat [*] is the first choice. Legacy splat .*. remains for compatibility, but you should avoid it in new code. Use a for expression ([for v in xs : v.attr]) when you also need to filter or transform.

• Basic form: list_or_object[*].attribute
• Legacy form: list_or_object.*.attribute (not recommended for new code)
• For transformations, use a for expression: [for v in list : upper(v.name)]

Visualizing a splat expression

Input (list of objects)

  [
    { id: "i-001", name: "app-a" },
    { id: "i-002", name: "app-b" },
    { id: "i-003", name: "app-c" }
  ]
            |
            |  apply [*].id
            v
  [ "i-001", "i-002", "i-003" ]  ← only the id attribute, extracted in bulk

Minimal full splat example

variable "instances" {
  type = list(object({ id = string, name = string }))
}

locals {
  ids   = var.instances[*].id
  names = var.instances[*].name
}

output "ids" {
  value = local.ids
}

Behavior and Ordering by Collection Type

Splat behavior depends on the target collection type. Lists/tuples preserve definition order. Sets have no order, so the result order is undefined. Maps/objects depend on key order, but a direct splat on them does not always make that order explicit.

Resources or modules created via for_each become objects (a keyed collection). If you need a list with stable order, convert to a value list with values(...). values(map) corresponds to the lexical order of keys(map), so the result is stable.

• list/tuple: definition order preserved → xs[*].attr gives stable order
• set: no order → use helpers like tolist() + sort() (strings only) when needed
• map/object (for_each): values(obj)[*].attr is simple and stable

Getting IDs in stable order from a for_each resource

resource "aws_instance" "web" {
  for_each = { a = "10.0.0.10", c = "10.0.0.12", b = "10.0.0.11" }
  ami           = "ami-12345678"
  instance_type = "t3.micro"
  private_ip    = each.value
}

# Stable IDs (lexical key order: a, b, c)
locals {
  web_ids = values(aws_instance.web)[*].id
}

output "web_ids" {
  value = local.web_ids
}

Splat vs. for: Comparison and When to Use Which

For simple attribute extraction, splat is concise. When you also want conditional extraction or transformation, a for expression fits better. Legacy splat (.*.) is discouraged for readability and future-proofing reasons.

Associate exam questions often check whether you understand the equivalent forms (xs[*].attr vs. [for x in xs : x.attr]), whether values() is needed to get a stable-order list from a map/object, and whether filtering is required.

• Extraction only → splat
• Extraction + condition/transform → for expression
• for_each → wrap with values(...) for stable order

Equivalent forms and a filtered example

locals {
  # Equivalent: simple extraction
  ids_via_splat = aws_instance.web[*].id
  ids_via_for   = [for r in aws_instance.web : r.id]

  # Transformation + condition: for expression is the right tool
  names_upper_enabled = [
    for r in aws_instance.web : upper(r.tags["Name"]) if try(r.tags["enabled"], "false") == "true"
  ]
}

Real-World Patterns: Module Outputs, Nesting, and Helper Functions

When you invoke a module multiple times with count or for_each, module.<NAME> becomes a collection. You can collect outputs in bulk with a splat like module.db[*].endpoint. For for_each, values(module.db)[*].endpoint makes the order explicit.

When you combine nested splats and for expressions, normalizing and absorbing edge cases with functions like flatten, compact, try, and coalesce keeps things robust.

• Modules with for_each: values(module.mod)[*].output
• Nesting: process step by step, e.g., flatten([for m in modules : m[*].ids])
• Missing value handling: drop in try(..., []) and coalesce(..., []) where appropriate

Safely collecting module outputs

module "db" {
  source   = "./modules/db"
  for_each = { a = {}, b = {}, c = {} }
}

# Endpoint list in stable order
locals {
  db_endpoints = values(module.db)[*].endpoint

  # Nested: assume each DB module returns multiple replica endpoints
  # module.db[each].replicas is list(string)
  replica_lists = values(module.db)[*].replicas
  all_replicas  = flatten(local.replica_lists)

  # Resilient to missing values (some modules may have null replicas)
  safe_all_replicas = flatten([for m in values(module.db) : coalesce(m.replicas, [])])
}

output "db_endpoints" {
  value = local.db_endpoints
}

Pitfalls and Guards: null/unknown Values and Ordering

When inputs contain values that are unknown at plan time or are null, the splat result can include unknown or null entries. Passing that straight into other computations can cause type mismatches or surprise diffs, so it is safer to normalize early with try, compact, and coalesce.

Splats over sets or objects tend to leave the order undefined. When you need a stable order, pin it explicitly with values(...) or a for expression driven by sort(keys(...)).

• Null guard: coalesce(var.items, [])[*].id
• Unknown values: fall back with try(xs[*].id, [])
• Fix the order: [for k in sort(keys(obj)) : obj[k].id]

Robustness snippet collection

# 1) Allow splat even when input is null by defaulting to an empty list
locals {
  safe_ids = coalesce(var.maybe_items, [])[*].id
}

# 2) Suppress evaluation-time errors
locals {
  try_ids = try(aws_instance.web[*].id, [])
}

# 3) Stable-order extraction from an object (ascending keys)
locals {
  ids_ordered = [for k in sort(keys(aws_instance.web)) : aws_instance.web[k].id]
}

Mini Exercise: Extracting and Filtering Subnet IDs

A small example that filters private subnets in a VPC by tag and produces a list of IDs. Extraction is done with splat, filtering with a for expression, and the final result is an ID-only array.

For the Associate exam, it is enough to be solid on choosing between splat and for expressions, stabilizing order with values(), and the basics of compact/flatten.

• Fetch with data.aws_subnets → stabilize order with values()
• Filter by tag with a for expression
• Extract the final ID array with splat or a for expression

Subnet ID extraction sample

data "aws_subnets" "selected" {
  tags = {
    Tier = "private"
  }
}

# data.aws_subnets.selected.ids is a set(string)
# If order matters, combine tolist() + sort() (strings only)
locals {
  subnet_ids_unsorted = data.aws_subnets.selected.ids
  subnet_ids_sorted   = sort(tolist(local.subnet_ids_unsorted))

  # To layer in extra conditions (e.g., only /24 CIDRs), use a for expression
  # Example assumes data.aws_subnet.this[*] has the necessary attributes — adapt to your real data reference
  # ids_only = [for s in values(data.aws_subnet.this) : s.id if can(regex("/24

      

        
        NicheeLab を読み込み中…
      
    
  quot;, s.cidr_block))]
}

output "subnet_ids_sorted" {
  value = local.subnet_ids_sorted
}

Check Your Understanding

Frequently Asked Questions