Module 4, Variables, Outputs, Locals

Input Variables

Variables make your configuration reusable:

variable "aws_region" {
  description = "AWS region to deploy into"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Deployment environment"
  type        = string

  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}

variable "db_password" {
  description = "Database master password"
  type        = string
  sensitive   = true   # never printed in logs or plan output
}

Variable Types

variable "port_number"        { type = number }
variable "enable_logging"     { type = bool }
variable "availability_zones" { type = list(string) }
variable "tags"               { type = map(string) }
variable "database_config" {
  type = object({
    engine  = string
    version = string
    port    = number
  })
}

Variable Precedence (lowest → highest)

# 1. Default value in variable block
# 2. terraform.tfvars (auto-loaded)
aws_region = "eu-north-1"

# 3. *.auto.tfvars (auto-loaded)
environment = "production"

# 4. Environment variable
export TF_VAR_db_password="SecurePass123!"

# 5. Command line flag (HIGHEST)
terraform apply -var="aws_region=us-west-2"

warning

Command line -var always wins. Use this for CI/CD overrides.

Output Values

output "bucket_arn" {
  description = "ARN of the S3 bucket"
  value       = aws_s3_bucket.main.arn
}

output "database_endpoint" {
  description = "RDS connection endpoint"
  value       = aws_db_instance.main.address
  sensitive   = true   # hidden in terminal output
}

output "app_url" {
  value = "http://${aws_elastic_beanstalk_environment.main.cname}"
}

terraform output              # all outputs
terraform output bucket_arn   # specific output
terraform output -json        # machine-readable

Local Values

Locals are computed values you use repeatedly:

locals {
  common_tags = {
    Project     = var.app_name
    Environment = var.environment
    ManagedBy   = "terraform"
  }

  bucket_name  = "${var.app_name}-${var.environment}-${data.aws_caller_identity.current.account_id}"
  is_production = var.environment == "production"
}

resource "aws_s3_bucket" "artifacts" {
  bucket = local.bucket_name
  tags   = local.common_tags
}

resource "aws_db_instance" "main" {
  multi_az = local.is_production
  tags     = local.common_tags
}

Lab 3, Parameterised Configuration

# variables.tf
variable "aws_region"   { type = string; default = "us-east-1" }
variable "vpc_cidr"     { type = string; default = "10.0.0.0/16" }
variable "environment"  { type = string; default = "dev" }

# locals.tf
locals {
  name_prefix = "${var.environment}-finpay"
  common_tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

# terraform.tfvars
aws_region  = "us-east-1"
environment = "dev"

Knowledge Check

1. What is the order of precedence for setting variable values?
2. What does sensitive = true do to a variable or output?
3. What is the difference between a variable and a local?
4. When would you use validation on a variable?
5. How do you pass secrets to Terraform without putting them in a file?
6. What command shows all output values after apply?

Exam Mapping

• HashiCorp Associate Obj 4a: Interact with Terraform modules
• HashiCorp Associate Obj 8c: Built-in dependency management