When one Terraform block needs several configurations of the same type, use subblocks: nested, label-free blocks that normally may repeat. Unlike arguments, they have no equals sign and can appear multiple times. section 2.2.3
Listing 2.7 HCL block components
type "label" { #1
parameter1 = "value" #2
parameter2 = "value" #3
parameter3 = true #4
parameter4 = 12 #5
parameter5 = { #6
key = "value"
}
parameter6 = null #7
subblock { #8
sub_parameter1 = "value"
sub_parameter2 = "value"
sub_parameter3 = "value"
}
subblock { #9
sub_parameter1 = "value"
sub_parameter2 = "value"
sub_parameter3 = "value"
}
}
A generic HCL block shows repeated subblocks nested alongside arguments; each subblock contains its own settings. section 2.2
Subblocks behave like grouped modifiers of an enclosing block. Data sources commonly use repeated filter subblocks to stack selection criteria, while resources can use them for repeated rules. A lifecycle subblock instead groups related settings as a namespace. section 2.2.3
Multiple firewall rules
A GCP firewall can contain separate allow subblocks for ICMP, TCP ports 80 and 443, and UDP port 53. Each block describes one rule while the enclosing resource identifies the firewall and network. section 2.2.3
Listing 2.14 A GCP firewall using multiple subblocks
resource "google_compute_network" "example" { #1
name = "example-network"
}
resource "google_compute_firewall" "example" {
name = "example-firewall"
network = google_compute_network.example.name #2
allow { #3
protocol = "icmp"
}
allow { #4
protocol = "tcp"
ports = ["80", "443"]
}
allow { #5
protocol = "udp"
ports = ["53"]
}
source_ranges = ["0.0.0.0/0"]
}
The listing connects repeated allow subblocks to a real network and firewall resource configuration. section 2.2.3
Distinguish subblocks from nearby Terraform constructs:
- Arguments use name-value assignments, can normally appear only once per enclosing block, and may export their values as attributes. section 2.2.3 section 2.2.4
- Subblocks have no assignment character and can normally repeat, but their contents are not accessible as attributes. section 2.2.3 section 2.2.4
- Provider-defined resource and data-source schemas determine which arguments and subblocks are available. section 2.2.3
Listing 2.13 Terraform data source with multiple subblocks
data "aws_ami" "ubuntu" {
owners = ["099720109477"] #1
most_recent = true
filter {
name = "virtualization-type" #2
values = ["hvm"] #2
}
filter { #3
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
}
}
The data source demonstrates two filter subblocks selecting an AMI through separate criteria. section 2.2.3
For readable configuration, place block-specific subblocks after block-specific arguments and before any meta-argument subblock. Terraform can still plan configurations that ignore the suggested order; terraform fmt applies formatting rules automatically. section 2.2.6
