Terraform:Terraform output

What are outputs

An output is similar to a return value in a programming language. Outputs let you expose infrastructure attributes after terraform apply so you can inspect them, pass them between modules, or feed them into other tools.

Common use cases:

• Print resource attributes — display computed values (such as an ECS instance ID or IP address) in the CLI after terraform apply

• Pass data between resources — extract an attribute from one resource and reference it in another, such as using a VPC's IP address in a security group rule

• Share data across modules — expose values from a child module so a parent module can reference them

• Integrate with external tools — pipe output values into scripts or CI/CD pipelines using terraform output

Syntax for outputs

Declare outputs in an output block. You can place output blocks anywhere in your Terraform configuration files. However, we recommend placing them in a dedicated file named outputs.tf to make your configuration easier to navigate.

The label after the output keyword is the output name. Output names must be unique within the module. An output block accepts the following arguments:

1. value

   (Required) The value to return to the user of the module.

2. description

   (Optional) A human-readable description of the output's purpose. Terraform uses this description to generate documentation about the module.

3. sensitive

   (Optional) A Boolean indicating if the output is sensitive. If true, Terraform redacts the value from CLI output to prevent leaking confidential data, such as passwords or an AccessKey Secret.

The following example declares an output named vpc_id for a resource named my-vpc:

# Create a VPC
resource "alicloud_vpc" "my-vpc" {
  vpc_name   = "tf-vpc"
  cidr_block = "10.0.0.0/16"
}
output "vpc_id" {
  value = alicloud_vpc.my-vpc.id
}

After terraform apply succeeds, the VPC ID appears in the CLI output:

alicloud_vpc.my-vpc: Creating...
alicloud_vpc.my-vpc: Creation complete after 7s [id=vpc-bp1gcq59rsakmwx1apmhn]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
Outputs:
vpc_id = "vpc-bp1gcq59rsakmwx1apmhn"

Query outputs with the terraform output command

For already-created resources, run terraform output at any time to view all output values:

$ terraform output
vpc_id = "vpc-bp1gcq59rsakmwx1apmhn"

To retrieve a single value as a raw string (suitable for shell scripts):

$ terraform output -raw vpc_id
vpc-bp1gcq59rsakmwx1apmhn

To retrieve all outputs as JSON (suitable for programmatic consumption):

$ terraform output -json
{
  "vpc_id": {
    "sensitive": false,
    "type": "string",
    "value": "vpc-bp1gcq59rsakmwx1apmhn"
  }
}

Access outputs from a child module

A parent module accesses a child module's outputs using module.<MODULE_NAME>.<OUTPUT_NAME>:

module "network" {
  source = "./modules/network"
}

resource "alicloud_security_group_rule" "allow_vpc" {
  cidr_ip = module.network.vpc_cidr_block
}

The child module (./modules/network) must declare the output:

output "vpc_cidr_block" {
  description = "CIDR block of the VPC"
  value       = alicloud_vpc.main.cidr_block
}

Best practices for outputs

1. Output only useful information

   Export computed attributes, not static values that simply repeat a variable. For a network resource, useful outputs include:

   1. id: the identifier of the resource.

   2. router_id: the identifier of the router automatically created for the VPC.

   3. route_table_id: the identifier of the route table automatically created for the VPC.

2. Use meaningful names and descriptions — follow the same conventions as variable names and provide a description argument to document the output's intent.

3. Place all outputs in outputs.tf — a dedicated file makes it easy to review what your configuration exposes.

4. Mark sensitive outputs

   Use Terraform's built-in sensitive = true instead of manually encrypting values. When an output is marked as sensitive, Terraform redacts its value from the output of terraform plan and terraform apply.