State Sharing #

# The "networking" configuration produces outputs:
# outputs.tf in the networking workspace

output "vpc_id" {
  value       = aws_vpc.main.id
  description = "VPC ID — consumed by the compute and database workspaces"
}

output "private_subnet_ids" {
  value       = aws_subnet.private[*].id
}

output "database_subnet_ids" {
  value       = aws_subnet.database[*].id
}

# The "compute" configuration reads the networking state
data "terraform_remote_state" "networking" {
  backend = "s3"

  config = {
    bucket = "my-terraform-state"
    key    = "production/networking/terraform.tfstate"
    region = "ap-southeast-1"
  }
}

resource "aws_instance" "app" {
  ami       = data.aws_ami.ubuntu.id
  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]
}

# The "compute" configuration receives values as variables — doesn't know their origin
variable "vpc_id" {
  description = "ID of the VPC where resources will be placed"
  type        = string
}

variable "private_subnet_ids" {
  description = "List of private subnet IDs"
  type        = list(string)
}

resource "aws_instance" "app" {
  ami       = data.aws_ami.ubuntu.id
  subnet_id = var.private_subnet_ids[0]
}

# Method 1: Grab outputs from another configuration manually
cd environments/production/networking
NETWORKING_OUTPUTS=$(terraform output -json)

VPC_ID=$(echo $NETWORKING_OUTPUTS | jq -r '.vpc_id.value')
SUBNET_IDS=$(echo $NETWORKING_OUTPUTS | jq -r '.private_subnet_ids.value | @json')

# Then pass them to the compute configuration
cd ../compute
terraform apply \
  -var="vpc_id=$VPC_ID" \
  -var="private_subnet_ids=$SUBNET_IDS"

# Method 2: A CI/CD pipeline passing values between configurations
# .github/workflows/deploy.yml

jobs:
  deploy-networking:
    outputs:
      vpc_id: ${{ steps.outputs.outputs.vpc_id }}
      subnet_ids: ${{ steps.outputs.outputs.subnet_ids }}
    steps:
      - name: Apply networking
        run: terraform apply -auto-approve
        working-directory: environments/production/networking

      - name: Capture outputs
        id: outputs
        run: |
          echo "vpc_id=$(terraform output -raw vpc_id)" >> $GITHUB_OUTPUT
          echo "subnet_ids=$(terraform output -json private_subnet_ids)" >> $GITHUB_OUTPUT          
        working-directory: environments/production/networking

  deploy-compute:
    needs: deploy-networking
    steps:
      - name: Apply compute
        run: |
          terraform apply -auto-approve \
            -var="vpc_id=${{ needs.deploy-networking.outputs.vpc_id }}" \
            -var='private_subnet_ids=${{ needs.deploy-networking.outputs.subnet_ids }}'          
        working-directory: environments/production/compute

# After the networking apply, generate an outputs.auto.tfvars file
# that will be automatically read by the compute configuration

# Script or CI step after the networking apply:
# terraform output -json | jq '{
#   vpc_id: .vpc_id.value,
#   private_subnet_ids: .private_subnet_ids.value
# }' > ../compute/networking-outputs.auto.tfvars.json

# environments/compute will read this file automatically
# (*.auto.tfvars.json is read without needing -var-file)

# ANTI-PATTERN: A reads B's state, B reads A's state
# A circular dependency that can't be applied without breaking the cycle

# networking/main.tf:
data "terraform_remote_state" "compute" {
  # Networking reads outputs from compute
  config = { key = "production/compute/terraform.tfstate" ... }
}

# compute/main.tf:
data "terraform_remote_state" "networking" {
  # Compute reads outputs from networking
  config = { key = "production/networking/terraform.tfstate" ... }
}

# Problem:
# - networking can't be applied because it needs compute's state
# - compute can't be applied because it needs networking's state
# - Nothing can run first (chicken-and-egg)

# SOLUTION: Identify the "foundational" resources
# and separate them into a configuration that doesn't depend on any other

# Workspace A: networking — outputs the VPC and subnets
output "vpc_id" {
  value = aws_vpc.main.id
}

output "private_subnet_ids" {
  value = aws_subnet.private[*].id
}

# Workspace B: compute — reads from workspace A
data "terraform_remote_state" "networking" {
  backend = "s3"
  config = {
    bucket = "terraform-state"
    key    = "networking/terraform.tfstate"
    region = "ap-southeast-1"
  }
}

resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]
}

# PROBLEM: terraform_remote_state can access ALL outputs
# Including sensitive ones!

# SOLUTION 1: Create dedicated outputs for sharing (without sensitive data)
output "shared_info" {
  description = "Info for other workspaces (non-sensitive)"
  value = {
    vpc_id     = aws_vpc.main.id
    subnet_ids = aws_subnet.private[*].id
    # DON'T include: passwords, API keys, etc.
  }
}

# SOLUTION 2: Use a data source from the provider directly
data "aws_vpc" "shared" {
  filter {
    name   = "tag:Name"
    values = ["shared-vpc"]
  }
}
# Safer — only fetches the needed info

# Approach 1: terraform_remote_state
data "terraform_remote_state" "networking" {
  backend = "s3"
  config = {
    bucket = "tf-state"
    key    = "networking/terraform.tfstate"
    region = "ap-southeast-1"
  }
}

# Then:
resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]
}

# Approach 2: Provider data source (PREFERRED)
data "aws_vpc" "shared" {
  tags = { Name = "shared-vpc" }
}

data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.shared.id]
  }
  filter {
    name   = "tag:Tier"
    values = ["private"]
  }
}

# Then:
resource "aws_instance" "web" {
  subnet_id = data.aws_subnets.private.ids[0]
}