File & Environment #

# environments/dev.tfvars
environment    = "dev"
instance_type  = "t3.micro"
instance_count = 1

database_config = {
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  multi_az          = false
  backup_retention  = 1
}

tags = {
  Environment = "dev"
  CostCenter  = "engineering"
  ManagedBy   = "terraform"
}

# environments/production.tfvars
environment    = "production"
instance_type  = "t3.medium"
instance_count = 3

database_config = {
  instance_class    = "db.r5.large"
  allocated_storage = 500
  multi_az          = true
  backup_retention  = 30
}

tags = {
  Environment = "production"
  CostCenter  = "engineering"
  ManagedBy   = "terraform"
}

# Use at apply time
terraform apply -var-file="environments/dev.tfvars"
terraform apply -var-file="environments/production.tfvars"

# terraform.tfvars — default values, committed to Git
# (don't store secrets here)

region   = "ap-southeast-1"
owner    = "platform-team"

common_tags = {
  Project   = "my-app"
  ManagedBy = "terraform"
  Repository = "github.com/org/infrastructure"
}

# Values that are the same in every environment
enable_monitoring  = true
log_retention_days = 30

# Terraform reads TF_VAR_<variable_name> automatically
# The variable name must be an EXACT MATCH (case-sensitive)

export TF_VAR_environment="production"
export TF_VAR_instance_type="t3.medium"

# For variables with complex types, use the HCL/JSON format
export TF_VAR_database_config='{"instance_class":"db.r5.large","allocated_storage":500,"multi_az":true}'

terraform apply
# Terraform reads TF_VAR_* and uses them as variable values

# Usage example in GitHub Actions CI/CD
name: Terraform Apply Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Apply
        env:
          # Non-sensitive values from the tfvars file
          TF_VAR_environment: "production"
          # Secrets from GitHub Secrets — never enter the code
          TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
          TF_VAR_api_key: ${{ secrets.API_KEY }}
          # AWS credentials
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: terraform apply -auto-approve -var-file="environments/production.tfvars"

# APPROACH 1: Read secrets from AWS Secrets Manager via a data source
# The secret is managed outside Terraform; Terraform only reads it

data "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = "production/database/credentials"
}

locals {
  db_credentials = jsondecode(
    data.aws_secretsmanager_secret_version.db_credentials.secret_string
  )
}

resource "aws_db_instance" "main" {
  username = local.db_credentials.username
  password = local.db_credentials.password
  # ... other attributes
}

# APPROACH 2: Sensitive variables filled via TF_VAR_* environment variables
# The secret is managed in the CI/CD secrets manager (GitHub Secrets, HashiCorp Vault)
# and passed to Terraform as an environment variable

variable "db_password" {
  type      = string
  sensitive = true
  # No default — Terraform will error if TF_VAR_db_password isn't set
}

resource "aws_db_instance" "main" {
  password = var.db_password
}

# ANTI-PATTERN 1: Secrets in .tfvars files committed to Git
# production.tfvars
db_password = "super-secret-password"  # ✗ Leaks to everyone with repo access
api_key     = "«redacted:sk-…»"   # ✗ Stored in Git history forever

# ANTI-PATTERN 2: One tfvars file for all environments
# all-environments.tfvars
dev_instance_type  = "t3.micro"        # ✗ The file becomes big and confusing
prod_instance_type = "t3.medium"
dev_db_class       = "db.t3.micro"
prod_db_class      = "db.r5.large"
# Better: a separate file per environment

# ANTI-PATTERN 3: Hardcoded values in the configuration that should be variables
resource "aws_instance" "web" {
  instance_type = "t3.micro"   # ✗ Hardcoded — can't differ per environment
}
# Better: instance_type = var.instance_type

// terraform.tfvars.json
{
  "environment": "production",
  "instance_type": "t3.medium",
  "instance_count": 3,
  "tags": {
    "Project": "MyApp",
    "ManagedBy": "Terraform"
  }
}

# terraform.tfvars.json is read automatically, same as terraform.tfvars
terraform plan

# The loading order for JSON is the same as HCL:
# 1. terraform.tfvars.json (if present, together with terraform.tfvars)
# 2. *.auto.tfvars.json (alphabetical)
# 3. -var-file flag

# Common pattern: one tfvars file per environment
# environments/
#   ├── dev.tfvars
#   ├── staging.tfvars
#   └── production.tfvars

terraform plan -var-file="environments/production.tfvars"
terraform apply -var-file="environments/staging.tfvars"

# In CI/CD, pick the file based on the branch or a parameter
if [ "$ENVIRONMENT" == "production" ]; then
  terraform apply -var-file="environments/production.tfvars" -auto-approve
elif [ "$ENVIRONMENT" == "staging" ]; then
  terraform apply -var-file="environments/staging.tfvars" -auto-approve
fi

VARIABLE PRIORITY (from low to high):

1. Default value in the variable declaration
   variable "x" { default = "low" }

2. terraform.tfvars (and terraform.tfvars.json)
   x = "medium-low"

3. *.auto.tfvars (and *.auto.tfvars.json) — alphabetical
   config.auto.tfvars: x = "medium"

4. -var-file flag
   terraform plan -var-file="custom.tfvars"
   x = "medium-high"

5. -var flag and TF_VAR_ environment variables
   terraform plan -var="x=high"
   TF_VAR_x="high" terraform plan

6. Input at the prompt (if there's no default)
   Terraform will ask for interactive input

# Example: override in CI/CD
# Default: terraform.tfvars → environment = "dev"
# CI/CD override:
terraform plan -var="environment=staging"
# This overrides the value in terraform.tfvars

# Environment variable override:
export TF_VAR_instance_type="t3.large"
terraform plan
# TF_VAR_instance_type overrides all other sources

# DON'T commit tfvars files containing secrets to Git!

# .gitignore:
*.tfvars
*.tfvars.json
!terraform.tfvars.example

# For shared (non-sensitive) values:
# Commit terraform.tfvars.example with placeholders

# terraform.tfvars.example (commit this)
# environment = "dev"
# instance_type = "t3.micro"
# db_password = "CHANGE_ME"

# terraform.tfvars (DON'T commit)
environment  = "production"
instance_type = "m5.large"
db_password   = "actually-secret-password"

# Alternative: use environment variables for secrets
# export TF_VAR_db_password="secret"
# Terraform will read from the TF_VAR_ prefix

TERRAFORM VARIABLE LOADING ORDER:

1. Environment variables (TF_VAR_*)
   └── Loaded automatically from the shell

2. terraform.tfvars
   └── Auto-loaded if present in the working directory

3. *.auto.tfvars
   └── Auto-loaded, alphabetical order

4. -var-file=explicit.tfvars
   └── Explicit, can specify multiple

5. -var="key=value"
   └── Command line, highest priority

NAMING CONVENTION:
common.tfvars       → Shared values across all envs
dev.tfvars          → Dev-specific values
staging.tfvars      → Staging-specific values
production.tfvars   → Production-specific values
secrets.tfvars      → NEVER commit (in .gitignore)

# Combine multiple var files
terraform apply   -var-file="common.tfvars"   -var-file="environments/dev.tfvars"   -var-file="regions/ap-southeast-1.tfvars"