diff --git a/command/hcl2_upgrade.go b/command/hcl2_upgrade.go
index 13148c430..bcb6936b2 100644
--- a/command/hcl2_upgrade.go
+++ b/command/hcl2_upgrade.go
@@ -322,7 +322,7 @@ func transposeTemplatingCalls(s []byte) []byte {
 			return fmt.Sprintf("${var.%s}", in)
 		},
 		"env": func(in string) string {
-			return fmt.Sprintf("${var.%s}", in)
+			return fmt.Sprintf("${env(%q)}", in)
 		},
 		"build": func(a string) string {
 			return fmt.Sprintf("${build.%s}", a)
diff --git a/command/test-fixtures/hcl2_upgrade_basic/expected.pkr.hcl b/command/test-fixtures/hcl2_upgrade_basic/expected.pkr.hcl
index 97b18111f..31091a90a 100644
--- a/command/test-fixtures/hcl2_upgrade_basic/expected.pkr.hcl
+++ b/command/test-fixtures/hcl2_upgrade_basic/expected.pkr.hcl
@@ -30,6 +30,11 @@ variable "aws_region" {
   type = string
 }
 
+variable "aws_secondary_region" {
+  type    = string
+  default = "${env("AWS_DEFAULT_REGION")}"
+}
+
 variable "aws_secret_key" {
   type      = string
   default   = ""
diff --git a/command/test-fixtures/hcl2_upgrade_basic/input.json b/command/test-fixtures/hcl2_upgrade_basic/input.json
index b6f9a9302..a7fca659b 100644
--- a/command/test-fixtures/hcl2_upgrade_basic/input.json
+++ b/command/test-fixtures/hcl2_upgrade_basic/input.json
@@ -3,6 +3,7 @@
     "variables": {
         "secret_account": "🤷",
         "aws_region": null,
+        "aws_secondary_region": "{{ env `AWS_DEFAULT_REGION` }}",
         "aws_secret_key": "",
         "aws_access_key": ""
     },