An elaborate example of using locals with template_cloudinit_config.

cloudinit-template-example.tf

locals {
  hashicorp_apt_gpg_key = file("${path.module}/config_files/hashicorp_apt_gpg_key.pub")
  cloudinit_config_server = {
    write_files = [
      {
        content = local.hashicorp_apt_gpg_key
        owner = "root:root"
        path = "/root/hashicorp-deb-key.pub"
        permissions = "0644"
      },
      {
        content = <<APT_NO_PROMPT_CONFIG
Dpkg::Options {
   "--force-confdef";
   "--force-confold";
}
APT_NO_PROMPT_CONFIG
        owner = "root:root"
        path = "/etc/apt/apt.conf.d/no-update-prompt"
        permissions = "0644"
      }
    ]
    runcmd = [
      [ "systemctl", "disable", "--now", "unattended-upgrades.service", "apt-daily-upgrade.service", "apt-daily-upgrade.timer" ],
      [ "apt", "install", "-y", "software-properties-common" ],
      [ "apt-key", "add", "/root/hashicorp-deb-key.pub" ],
      [ "apt-add-repository", "universe" ],
      [ "sh", "-c", "apt-add-repository \"deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main\"" ],
      [ "apt", "update" ],
      [ "sh", "-c", "UCF_FORCE_CONFFOLD=true apt upgrade -y" ],
      [ "apt", "install", "-y", "bind9-dnsutils", "jq", "curl", "unzip", "docker-compose" ],
      [ "systemctl", "enable", "--now", "apt-daily-upgrade.service", "apt-daily-upgrade.timer" ]
    ]
  }
}

data "cloudinit_config" "server" {
  gzip = false
  base64_encode = true
  part {
    content_type = "text/cloud-config"
    content = yamlencode(local.cloudinit_config_server)
  }
}

resource "aws_instance" "server" {
  [...]
  user_data_base64 = data.cloudinit_config.server.rendered
}