Terraform Variable Builder

A variable block declares an input variable for a Terraform module. It defines the variable's type, default value, description, and optional validation rules. Variables make modules reusable by parameterizing resource configurations. They are set via .tfvars files, -var flags, environment variables (TF_VAR_*), or Terraform Cloud workspace variables.

Terraform supports primitive types (string, number, bool) and structural types (list(), map(), set(), object(), tuple()). For example, list(string) is a list of strings, map(number) is a map with string keys and number values. You can also use any to disable type checking, but this reduces safety.

Add sensitive = true to the variable block. Terraform will redact the value in plan and apply output, and won't store it in state. Note: sensitive only prevents display in CLI output — the value is still stored in state. Use remote state with encryption (e.g., S3 with SSE-KMS) for production secrets.

A validation block adds custom constraints to a variable. It has condition (a bool expression using var.<name>) and error_message (shown when condition is false). Example: condition = can(regex('^[a-z][a-z0-9-]*$', var.name)) — ensures the name is lowercase and DNS-safe. Multiple validation blocks are allowed per variable.

By convention, declare all input variables in a file called variables.tf. Set values for local environments in terraform.tfvars (auto-loaded by Terraform). For multiple environments, use separate files: dev.tfvars, prod.tfvars, loaded with -var-file=prod.tfvars. Never commit .tfvars files with real secrets.

variable is for inputs — values provided externally to the module. local (in a locals block) is for intermediate computed values inside the module — think constants or expressions you reuse. output is for exposing values from a module to its caller or for display after terraform apply. They serve different roles in the data flow.