Outputs

Outputs expose values from a configuration or module — an instance's IP, a VPC's ID, a database endpoint — for humans to read after apply and for other modules and stacks to consume. They are the public return values of a module: the deliberate surface other code depends on, as opposed to its internal resources.

The mental model that matters is encapsulation. A module's resources are private. The only way anything outside the module can read a value from inside it is an output you declared. That makes the set of outputs a contract — and a contract you should keep small, because every output is something a consumer can come to depend on and you can no longer freely change.

Declaring an Output

An output block names a value and binds it to an expression — usually a resource attribute. After apply, Terraform prints the outputs, and you can query any one with terraform output vpc_id. The block below publishes a VPC's ID and a load balancer's DNS name for downstream use.

output "vpc_id" {
  value       = aws_vpc.main.id
  description = "ID of the application VPC"
}

output "alb_dns_name" {
  value       = aws_lb.app.dns_name
  description = "Public DNS name of the load balancer"
}

Outputs as a Module's Interface

When you call a child module, its outputs are the only thing you can read from it — module.network.vpc_id works because vpc_id is a declared output, while module.network.aws_vpc.main.id does not, because the resource is private to the module. This is why a module without outputs is a black box: it does its work, but the parent can't wire anything to it.

module "network" {
  source = "./modules/network"
  cidr   = "10.0.0.0/16"
}

resource "aws_instance" "app" {
  ami       = "ami-0abc123"
  subnet_id = module.network.private_subnet_id
}

Sensitive Outputs

Marking an output sensitive = true suppresses its value from the CLI display after apply, so a generated password or token does not print into a terminal or a retained CI log. As with sensitive variables, this controls display only — the value still lives in state, and a consumer that references the output still receives the real value. Forgetting sensitive on a secret output is a direct way to leak it into searchable logs.

output "db_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

Outputs for Machines

terraform output prints human-formatted text; terraform output -json prints structured JSON that a script can parse reliably. Anything programmatic — a CI step reading an ARN, a wrapper feeding instance IPs into an Ansible inventory — should consume the JSON form. Parsing the human text breaks the first time the display format changes, and it changes between versions.

# reliable: structured JSON for scripts
terraform output -json > outputs.json

# a single value, raw, for shell use
BUCKET=$(terraform output -raw bucket_name)

Cross-Stack Outputs

An output in one configuration often becomes an input to another. The tight-coupling route is terraform_remote_state, which reads another stack's outputs directly and creates a hidden ordering dependency. The looser route is publishing the value to SSM Parameter Store and reading it as a data source, which decouples the two stacks so the producer can move or restructure without breaking the consumer.