Motivation

Terraform HCL parsing still had gaps for a few expression node types that appear in real modules. When those nodes were hit, splat traversals could lose their trailing path, template %{for} blocks could not be rendered, and some synthetic or invalid-expression placeholders fell through to generic unsupported handling.

Changes

Splat traversals

Splat expressions with a trailing attribute or index were truncated because the anonymous splat item in the AST was not handled.

# input
security_group_ids = aws_security_group.app[*].id

# before
"aws_security_group.app[*]"

# after
"aws_security_group.app[*].id"

Template for-loops

%{for} / %{endfor} template directives produce a TemplateJoinExpr in the AST. That shape was unsupported in some parsing paths.

# input
user_data = "%{for v in var.subnets}${v.cidr}%{endfor}"

# before
"__UNSUPPORTED_EXPR__"

# after
"[for v in var.subnets : v.cidr]"

Remaining HCL expression types

AnonSymbolExpr (the synthetic item inside var.list[*].id) and ExprSyntaxError (placeholder for invalid or incomplete expressions) now have explicit handling in the shared HCL expression visitor instead of falling through to the default fallback.

# splat with nested traversal
bucket = aws_s3_bucket.logs[*].bucket

# before → "aws_s3_bucket.logs[*]"
# after  → "aws_s3_bucket.logs[*].bucket"

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

1. go test ./pkg/hclexpr/... ./pkg/engine ./pkg/builder/engine/... ./pkg/parser/terraform/...
2. Splat with traversal: parse var.list[*].id and confirm the rendered path is var.list[*].id, not var.list[*].
3. Template for-loop: parse %{for v in var.list}${v}%{endfor} and confirm it renders as [for v in var.list : v].

Blast Radius

Datadog IaC Scanner Terraform parsing only: HCL expression rendering in the inspector, engine string conversion, module resolver, and shared hclexpr dispatch.

Additional Notes

N/A

I submit this contribution under the Apache-2.0 license.