Learn how to expose important information from Terraform configurations using output values, including best practices for sensitive data.

What Will You Learn? #

Outputs are how Terraform displays important information after an apply finishes — such as IP addresses, URLs, or ARNs. Outputs are also used to connect modules and stacks. This section covers output declaration, contract design, and sensitive data handling.

Articles in This Section #

Output Flow #

flowchart TD
    subgraph Terraform Config
        R["Resource<br/>(data in the cloud)"]
        O["Output Block<br/>value = R.attribute"]
    end

    subgraph Consumers
        CLI["CLI Output<br/>terraform output"]
        MOD["Other Module<br/>module.vpc.vpc_id"]
        CD["CI/CD Pipeline<br/>--json parsing"]
        APP["Application<br/>data source"]
    end

    R --> O
    O --> CLI
    O --> MOD
    O --> CD
    O --> APP

    style Terraform Config fill:#e3f2fd
    style Consumers fill:#e8f5e9

Output Contract Design #

flowchart LR
    subgraph Module Outputs
        VPC_ID["vpc_id<br/>string"]
        SUBNETS["subnet_ids<br/>list(string)"]
        SG_ID["security_group_id<br/>string"]
    end

    subgraph Consumers
        APP["App Module<br/>needs subnet + SG"]
        DB["DB Module<br/>needs VPC + subnet"]
    end

    VPC_ID --> DB
    SUBNETS --> APP
    SUBNETS --> DB
    SG_ID --> APP

    style Module Outputs fill:#e3f2fd
    style Consumers fill:#e8f5e9

Sensitive Data Handling #

# ✅ Correct: Mark as sensitive
output "db_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

# ✅ Access with a special flag
# terraform output -raw db_password

After understanding outputs, continue to Datasource to learn how to read data from the cloud without managing it.