Outputs

Outputs are a configuration's return values: the attributes you deliberately expose so a human, another module, or a CI step can read them after apply. They are the counterpart to input variables — inputs flow in, outputs flow out — and on a module they are the entire public interface.

When the Hatch ingest pipeline becomes a module, its outputs are what the outside world sees: the raw bucket name, the Pub/Sub topic id, the Cloud Run service URL. Everything else — the IAM bindings, the intermediate names, the API-enablement resources — is internal detail the caller never touches. Deciding what to output is deciding what the module promises.

Declaring an Output

An output block surfaces one value. output "raw_bucket_name" { value = google_storage_bucket.raw.name } exposes the bucket's name; after apply it prints to the CLI and is queryable with terraform output. From a module, that same output is read by the caller as module.ingest.raw_bucket_name — the name you give the output is the name the caller uses.

output "raw_bucket_name" {
  value       = google_storage_bucket.raw.name
  description = "Name of the raw-events ingest bucket"
}

output "topic_id" {
  value = google_pubsub_topic.events.id
}

After terraform apply, both print at the end of the run, and terraform output -json renders them as machine-readable JSON for a downstream CI step to consume.

Outputs as the Module Interface

A module's outputs are its contract with the outside world. The caller wires module.ingest.topic_id into the next module's input — the enrichment module's source_topic, say — so outputs are how composed infrastructure passes handles between modules without one reaching into another's internals. The producing module exposes a stable name; the consuming module depends on that name, not on the resource behind it.

The sensitive Flag

sensitive = true redacts a value in plan and apply output, so a generated service-account key or the enrichment-api-key secret payload does not land in CI logs or a pull-request plan comment where it is captured forever. The redaction is real and worth using — but it is log hygiene, not encryption. The value is still stored in plaintext in the state file, which is why the state itself must be protected as if every value were in the clear.

output "sa_key" {
  value     = google_service_account_key.processor.private_key
  sensitive = true   # hides it from CLI output — still plaintext in state
}

With sensitive = true, the plan shows (sensitive value) instead of the key. Without it, the private key prints into every log that captures the apply, including CI.

depends_on on an Output

An output can carry depends_on = [google_project_service.run] to force a consumer to wait until a side effect — an API enabled, an IAM binding propagated — has completed, even when the output's own value does not reference that resource. This is how a module signals "I am fully ready," not merely "here is a string." It matters when a downstream consumer would otherwise race ahead and call an API that is not yet enabled.

Use it sparingly. If the output value already references the resource it needs to wait on, Terraform infers the dependency and an explicit depends_on is just noise. It earns its place only for side effects the value itself does not mention.

Output Composition

An output does not have to be a raw passthrough. It can be computed — a constructed service URL, a jsonencode'd summary object, a merged labels map — so a module hands back exactly the shape its callers need instead of leaking every internal attribute. Composing the output is how you keep the module's surface small and intentional even when the resource behind it has dozens of attributes.

Root vs Module Outputs

The same output block plays two roles depending on where it sits. At the root, outputs are for humans and for terraform output -json consumers — they print what an operator wants to see after an apply. Inside a module, they are the only way data escapes the module boundary: a value not declared as an output simply does not exist outside the module, no matter that the resource is right there in the module's code.