What's New: Function Availability Validation

Function validation became the default in v0.24, and the validateFunctionVersions flag was removed. See the v0.24 upgrade guide.

CDK Terrain v0.23.4 regenerated the Fn bindings and added the validateFunctionVersions feature flag, making function usage safe across Terraform and OpenTofu.

What changed

`Fn` covers Terraform and OpenTofu

The function bindings are regenerated from current Terraform metadata and now also include OpenTofu-only functions. New on Fn:

Function	Terraform	OpenTofu
`issensitive`	>= 1.8.0	>= 1.7.0
`templatestring`	>= 1.9.0	>= 1.7.0
`ephemeralasnull`	>= 1.10.0	>= 1.11.0
`convert`	>= 1.15.0	—
`base64gunzip`	—	>= 1.7.0
`cidrcontains`	—	>= 1.7.0
`urldecode`	—	>= 1.7.0

cdktn convert understands these functions as well when converting existing HCL projects.

Refined return types for `format` and `formatlist`

Regenerating the bindings from current Terraform metadata also picks up upstream return-type refinements: Fn.format now returns string (previously any) and Fn.formatlist returns string[] (previously any). The rendered Terraform expressions are unchanged, but typed languages (TypeScript, Go, Java, C#) see the more precise signatures — code that relied on the old any return type may need a cast.

Synth-time validation of function usage

With the validateFunctionVersions feature flag enabled, every TerraformStack validates the functions used through Fn against the project’s declared targetVersions — the Terraform/OpenTofu ranges the project intends to support. Using a function that is not available across the entire declared range fails synthesis with a clear message:

Validation failed with the following errors:
  [MyStack] Terraform function "cidrcontains" is not supported by terraform, but the project targets terraform >=1.5.7. It is available in opentofu >=1.7.0.

Behavior details:

Functions that are available in every supported release (the vast majority) are never checked; only functions with limited availability are validated.
The check is purely declarative — no Terraform or OpenTofu binary is executed, so synth behaves identically in CI, package builds, and environments without either installed. Verifying the locally installed binary against the declared targets is a separate opt-in ("validateInstalledBinary": true) applied by commands that execute the CLI.
skipValidation: true on the App disables it along with all other validations.

Opting in during v0.23

In v0.23.4 the validation was opt-in. Projects created with cdktn init got the flag (and an explicit default targetVersions) automatically, and existing projects enabled it in cdktf.json:

{
  "targetVersions": {
    "terraform": ">=1.5.7",
    "opentofu": ">=1.6.0"
  },
  "context": {
    "validateFunctionVersions": "true"
  }
}

Limitations

Functions inside raw expression strings (overrides and other escape hatches) are not tracked.
Provider-defined functions (provider::<name>::<function>) are not validated; their availability depends on the provider, not the CLI.

See the Functions concept page for full documentation.

Getting Started

Overview

What's New: Function Availability Validation

What changed

`Fn` covers Terraform and OpenTofu

Refined return types for `format` and `formatlist`

Synth-time validation of function usage

Opting in during v0.23

Limitations

​What changed

​Fn covers Terraform and OpenTofu

​Refined return types for format and formatlist

​Synth-time validation of function usage

​Opting in during v0.23

​Limitations

What changed

`Fn` covers Terraform and OpenTofu

Refined return types for `format` and `formatlist`

Synth-time validation of function usage

Opting in during v0.23

Limitations