Output Values

Exam guide§2.4

Output values are Terraform's equivalent of a return value in a programming language: after resources are applied, they expose selected attributes back to the person - or the parent module - using the configuration. Most server details (an IP address, a resource id, a self-link URI) are calculated at deployment and can only be known after creation, so an output value is how you surface them.

Two uses of output values: print a resource's computed attributes in the CLI, and pass one resource's attributes into another module as an input variable.

Declare an output with an output block; the label after the keyword is the output's name. You can put it anywhere in a configuration, but the convention is a dedicated outputs.tf file.

The output block and its arguments

Argument	Required?	What it does
`value`	Required	The value returned to the user of the module - usually a computed resource attribute.
`description`	Optional	Explains the purpose of the output and the value expected; used for documentation.
`sensitive`	Optional	Masks the value so a confidential attribute (e.g. a password) is not printed by accident.

Here an output named picture_URL returns the uploaded object's self_link. After apply, the URL prints in the CLI under Outputs::

output "picture_URL" {
  description = "URL of the picture uploaded"
  # value = <resource_type>.<resource_name>.<attribute>
  value       = google_storage_bucket_object.picture.self_link
}

Terminal

google_storage_bucket_object.picture: Creating...
google_storage_bucket_object.picture: Creation complete after 1s
 
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 
Outputs:
picture_URL = "https://storage.googleapis.com/my-gallery/.."

After apply, the output value prints in the CLI under Outputs:

For a value that Terraform computes at deployment (an id, a self-link, an IP), read it from an output, not from a user-supplied input variable. The user can't know a computed value ahead of time, and hard-coding it defeats the point.

Query outputs with `terraform output`

Running terraform output prints every output value defined in the project - handy for piping a value into another command or confirming what a module exposes.

resource "google_compute_network" "vpc_network" {
  project = "<PROJECT_ID>"
  name    = "vpc-network"
}
output network_id {
  value = google_compute_network.vpc_network.id
}
output network_link {
  value = google_compute_network.vpc_network.self_link
}

Terminal

$ terraform output
network_id   = "projects/<project-id>/global/networks/vpc-network"
network_link = "https://www.googleapis.com/../projects/<project-id>/../vpc-network"

terraform output prints every output value defined in the project

Best practices

Output only useful, computed information. Don't regurgitate variables or restate known inputs - for a network, useful computed attributes are id, gateway_ipv4 (the default-route gateway address), and self_link (the URI of the created resource).
Name and describe meaningfully, exactly as you would for input variables.
Organize outputs in a file named outputs.tf.
Mark sensitive outputs with sensitive rather than trying to hand-encrypt them.

Output a computed attribute like id, not a value you already supplied as input - id is known only after apply, whereas name just echoes an input:

output network_id {
  value = google_compute_network.vpc-network.id        # useful - computed
}
output network_name {
  value = google_compute_network.vpc-network.name      # avoid - just echoes input
}

Mark sensitive outputs

Set sensitive = true on any output that carries confidential data, such as a database password. Terraform then relies on its built-in sensitive-state support instead of you manually encrypting the value.

output "sql_user_password" {
  value       = google_sql_user.users.password
  description = "The password for sql user."
  sensitive   = true
}

When an output (or attribute) is marked sensitive, its value is replaced with (sensitive) in the output of terraform plan and terraform apply, so it never lands in logs or a terminal by accident.

Terminal

$ terraform plan
Terraform will perform the following actions:
# some_resource.a will be created
+ resource "google_sql_user" "users" {
    + password = (sensitive)
  }
 
Plan: 1 to add, 0 to change, 0 to destroy.

A sensitive output is replaced with (sensitive) in plan and apply output

The output block and its arguments​

Query outputs with terraform output​

Best practices​

Mark sensitive outputs​

The output block and its arguments

Query outputs with `terraform output`

Best practices

Mark sensitive outputs