Terraform tfvars Generator

A .tfvars file provides actual values for variables declared in your Terraform modules. Instead of hardcoding values in variable declarations or passing them on the command line, you put them in terraform.tfvars (auto-loaded) or a named file like prod.tfvars (loaded with -var-file). This separates configuration from code.

variables.tf declares the variable schema — name, type, description, and optional defaults. terraform.tfvars provides the actual values for those variables. Keep variables.tf in source control; use .tfvars for environment-specific values (add prod.tfvars to .gitignore to avoid committing secrets).

Mark the variable as sensitive = true in variables.tf. Then set the value via the TF_VAR_name environment variable (e.g. export TF_VAR_db_password=secret) instead of putting it in a .tfvars file. For team use, store secrets in HashiCorp Vault, AWS Secrets Manager, or your CI/CD secrets store.

Create separate files: staging.tfvars, prod.tfvars. Apply with: terraform apply -var-file=prod.tfvars. Or use Terraform Workspaces combined with a lookup pattern. Avoid sharing the same state file between environments — use separate state backends (S3 buckets, Terraform Cloud workspaces) per environment.

string (quoted text), number (integer or float), bool (true/false), list(string) (ordered collection), map(string) (key-value pairs), object (structured type with named attributes). For complex types, you can also use set(string), list(object({...})), and optional() attributes in Terraform 1.3+.

It depends. Non-sensitive .tfvars (region, instance_type, feature flags) are fine to commit and useful for documentation. Sensitive .tfvars with passwords, API keys, or certificates should NOT be committed — add *.tfvars to .gitignore or use a .tfvars.example with placeholder values and document how to fill them in.