Support Base64 encoding of raw MD5 digest bytes #39436

Terraform Version

Terraform v1.16.6
on darwin_arm64

Use Cases

AWS WAF byte match rules can apply an MD5 text transformation to a request component before comparing it with SearchString. Writing such a rule requires the comparison value to be the Base64 encoding of the raw 16-byte MD5 digest.

Terraform's md5 function returns a hexadecimal string. base64encode(md5(value)) encodes the ASCII hexadecimal representation, not the raw digest bytes. The existing base64sha256 and base64sha512 functions provide the required behavior for their respective algorithms, but there is no MD5 equivalent or general conversion function.

This differs from converting between two provider arguments. The value is derived from arbitrary input and must match a transformation performed by the remote service.

Attempted Solutions

The closest expression using built-in functions is:

base64encode(md5(var.value))

This Base64-encodes the hexadecimal digest rather than the raw digest bytes.

A shell workaround is:

printf '%s' "$INPUT" | openssl dgst -md5 -binary | openssl base64 -A

Using this from Terraform requires an external data source, provider-defined function, or another out-of-process step. This adds dependencies and execution overhead for a deterministic transformation.

Proposal

Provide a built-in way to return the Base64 encoding of raw MD5 digest bytes.

One option is a base64md5 function, consistent with base64sha256 and base64sha512:

base64md5("hello world")

Alternatively, a general function that directly transcodes hexadecimal data to Base64 would allow composition without introducing binary strings:

base64_from_hex(md5("hello world"))

The exact API name is open for discussion. In either form, the result would be:

XrY7u+Ae7tCTyyK7j1rNww==

References

• New Feature interpolationFuncBase64Md5 #19245 requested base64md5 and was closed in favor of provider-side conversion.
• Hex string to binary conversion function #26163 requested hex-to-binary conversion and was closed after its original provider-specific use case was resolved.