Suppose a module creates an EC2 instance, and another resource needs its private IP address. An output makes that value available outside the module. Inputs pass values into a module; outputs expose values to its caller; locals remain inside it. Callers access an output as an attribute of the module block. section 3.2 section 3.8.3
Export and use an instance IP
In the module, define `output "aws_instance_ip" { value = aws_instance.hello_world.private_ip }`. A caller can then set a security-group ingress rule’s `cidr_ipv4` to `"${module.my_instance.aws_instance_ip}/32"`. The output passes the created instance’s address to the rule without requiring the caller to reach into the module’s resources. section 3.4.1
An `output` block’s `value` can refer to a resource attribute or another value local to the module. An optional `description` documents what callers receive. Outputs are commonly placed in `outputs.tf`; that filename is a convention, not a requirement for accessing them. section 3.4.1
Mark a password output `sensitive = true` to keep its value from being printed or logged by Terraform’s command-line interface. An output derived from a sensitive value must also be marked sensitive, or Terraform reports an error. This does not remove the value from Terraform state. section 3.4.2
Listing 6.5 Outputs in Terraform state
{
"outputs": { #1
"password": {
"value": "[-Cz\u003em@XQnZc", #2
"type": "string", #3
"sensitive": true #4
}
}
}
The state listing shows a root output with both its password value and `sensitive: true`: the flag does not erase the stored value. section 6.3.4
Terraform saves root-module outputs in state, allowing `terraform show` and `terraform_remote_state` to read them. Child-module outputs are not saved there as separate outputs; their values may instead be saved as attributes of resources that use them. An output already depends on its `value`. Add `depends_on` only when it must wait for something else—for example, a firewall rule—before becoming available. section 6.3.4 section 3.4.3
