Terraform Variables

Declaring variables

variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "dev"
}

variable "instance_count" {
  type    = number
  default = 2
}

variable "tags" {
  type    = map(string)
  default = { team = "web" }
}

output "summary" {
  value = "${var.instance_count} instances in ${var.environment} for team ${var.tags.team}"
}

summary = "2 instances in dev for team web"

Refer to a variable as var.<name>.

Setting values

In order of precedence (later wins):

1. The default in the declaration
2. terraform.tfvars and *.auto.tfvars files
3. -var-file=prod.tfvars on the command line
4. -var="region=eu-west-1" on the command line
5. Environment variables named TF_VAR_<name> (these come before files, after defaults)

# prod.tfvars
environment    = "prod"
instance_count = 3

Validation

variable "environment" {
  type    = string
  default = "staging"

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment must be dev, staging or prod."
  }
}

output "environment" {
  value = var.environment
}

environment = "staging"

Sensitive values

Mark secrets sensitive = true so Terraform hides them in plans and output. They are still stored in the state, so protect the state file. Since Terraform 1.10, ephemeral = true variables are never written to state or plan files at all.