How does Terraform's templatefile() function render a file, and what is allowed to be referenced from inside the template?

## The call and the scope rule ```hcl resource "aws_instance" "web" { # ... user_data = templatefile("${path.module}/user_data.sh.tftpl", { port = var.app_port workers = var.worker_count hosts = var.backend_hosts }) } ``` The second argument is a map, and it is the **complete** variable scope of the template. Inside `user_data.sh.tftpl`, `${port}` resolves; `${var.app_port}` does not — there is no `var` object in there at all. A template that references a name absent from the map fails with "Invalid function argument ... vars map does not contain key". This is deliberate: the template's inputs are its interface, visible at the call site, which makes the file reviewable in isolation and reusable from more than one call. `path.module` is the filesystem path of the module containing the call. Anchoring on it rather than a bare relative path is what makes the module work when it is called from another directory or consumed from a registry — a bare `"user_data.sh.tftpl"` resolves relative to the process working directory, not the module. ## The template language inside the file It is the same language as a quoted string, so: ```bash #!/bin/bash APP_PORT=${port} %{ for h in hosts ~} echo "${h}" >> /etc/app/backends %{ endfor ~} %{ if workers > 1 } systemctl set-property app.service TasksMax=${workers * 4} %{ endif } echo "home is $${HOME}" ``` The `~` on a directive trims the adjacent whitespace and newline, without which every loop iteration leaves a blank line. `$${HOME}` escapes the sigil so the shell — not Terraform — expands it; forgetting that escape is the single most common bug in templated shell scripts, and it presents as a Terraform error about an unknown variable named `HOME`. ## Documented limits - **The file must exist on disk** when the function is evaluated. You cannot generate the template itself during the run and then render it in the same operation — the value would need to be known before the resource that produces it is created. - **No recursion.** A template rendered by `templatefile` may not itself call `templatefile`. - **Rendering happens during evaluation**, so the rendered string is a normal value: if any input is unknown at plan time, the whole rendered result is unknown and the plan shows `(known after apply)` for that argument. A template that splices in an id from a resource not yet created will always look like that in the plan, which is expected, not a bug. ## Do not build JSON or YAML with it The recommended approach for structured output is to build the value in Terraform and encode it: ```hcl locals { policy = jsonencode({ Version = "2012-10-17" Statement = [{ Effect = "Allow", Action = ["s3:GetObject"], Resource = "${var.bucket_arn}/*" }] }) } ``` `jsonencode` and `yamlencode` guarantee syntactic validity and correct escaping; a hand-templated document breaks the first time an interpolated value contains a quote, a newline or a non-ASCII character, and it breaks at the consumer, not at plan time. When a template is unavoidable — a config file format with no encoder — you can still call `jsonencode` on individual values *inside* the template to escape them safely. ## Why the old template_file data source is gone Before `templatefile` existed, people used `data "template_file"` from the `hashicorp/template` provider. That provider is archived and no longer maintained, and it was never rebuilt for newer platforms — engineers on Apple Silicon hit an init failure because no matching provider binary exists. Adding it to new configuration buys a dependency you will have to remove. The function is a drop-in replacement and does not require a provider at all. Alongside it, `file()` simply reads a file's raw contents with no rendering, which is what you want for a static key or certificate. ## What an interviewer is checking Three things: that you know the vars map is the whole scope; that you anchor the path on `path.module`; and that you reach for an encoder rather than a template when the output is structured. The escaping and whitespace-trimming details show you have actually shipped a rendered script rather than read about one.