In Terraform, what does the idiom count = var.enabled ? 1 : 0 on a resource block do, and how do you then reference that resource's attributes elsewhere in the configuration?

## Why a meta-argument for multiplicity is used as an if-statement HCL has no `if` at the block level. You cannot write "declare this resource only when the flag is on". What you can do is declare it always and give it a multiplicity of zero, because `count` accepts any whole number including `0`, and a resource with zero instances creates nothing: ```hcl variable "create_bucket" { type = bool default = false } resource "aws_s3_bucket" "logs" { count = var.create_bucket ? 1 : 0 bucket = "app-logs-example" } ``` The expression is a normal conditional: `condition ? true_value : false_value`. With `create_bucket = false` the plan contains no bucket at all; flip it to `true` and the plan creates exactly one. This is the accepted idiom, and it is why `count` remains in everyday use even in codebases that otherwise prefer `for_each`. ## The price: the resource is now indexed forever Expansion happens whether the number is 0, 1 or 50. The moment a block carries `count`, its instances live at indexed addresses, so a reference to the whole resource is no longer valid: ```hcl # Error: because aws_s3_bucket.logs has count set, # its attributes must be accessed on specific instances output "id" { value = aws_s3_bucket.logs.id } # Valid, but crashes when count is 0 output "id" { value = aws_s3_bucket.logs[0].id } ``` `[0]` is fine inside a branch you know is taken, but any module that might be configured with the flag off will fail on index-out-of-range. This is the "ugly `[0]`" that spreads through a codebase once one optional resource appears. ## The splat plus one() pattern The splat operator on a counted resource yields a list of that attribute across all instances — length 1 when enabled, length 0 when not. `one()` collapses a zero-or-one-element list to either the element or `null`: ```hcl output "bucket_id" { value = one(aws_s3_bucket.logs[*].id) } ``` Now the output is the id when the bucket exists and `null` when it does not, and consumers can handle absence explicitly: ```hcl bucket = coalesce(one(aws_s3_bucket.logs[*].id), var.existing_bucket_id) ``` `one()` is available from Terraform 0.15 onward; before that people wrote `join("", aws_s3_bucket.logs[*].id)` to squash the list into an empty string, which is why that odd-looking `join` still shows up in older modules. Prefer `one()`: `null` is a real absence, an empty string is a value that will happily be passed somewhere it does not belong. ## The condition must be known at plan time Terraform must know how many instances exist before it can produce a diff, so the count expression cannot depend on something only computable during apply. Deriving it from a variable, a local, or a data source read at plan is fine; deriving it from an attribute of a resource being created in the same run is not, and the plan fails rather than guessing. Push conditionals up to inputs whenever you can. ## Toggling the flag is create/destroy, not pause Setting the flag to `false` on a live resource does not disable it — it removes the instance from the configuration, so the plan destroys the real object. That is the intended behaviour, but it is worth saying out loud in review: an innocuous-looking `enabled = false` in a tfvars file is a delete. For anything holding data, pair the pattern with an explicit review step, and remember that the resource comes back empty when the flag is flipped again. ## When for_each is the cleaner conditional For an optional *set* of resources rather than an optional single one, conditioning the collection reads better and keeps key addressing: ```hcl resource "aws_subnet" "extra" { for_each = var.enabled ? var.extra_subnets : {} # ... } ``` An empty map produces zero instances, exactly like `count = 0`, but the surviving instances stay key-addressed and no `[0]` is required anywhere. Use `count` for the single optional resource, and an empty-collection `for_each` when the thing being toggled is a group.