Why does my sensitive value still appear somewhere?

The sensitive flag only redacts command output. The value is stored in state, and some commands print sensitive outputs when you ask for them by name, so treat state and plan files as secret material.

What is the difference between a variable and a local?

A variable is an input that callers can set. A local is an internal named expression that cannot be set from outside. Use variables for the interface and locals for tidiness.

Terraform Variables, Outputs, and Locals

Introduction

Hard-coded values make a configuration useful once. Variables let the same code serve different environments, locals give names to computed values, and outputs expose results. This lesson adds all three to the first configuration and explains where values come from and how to handle sensitive ones.

Prerequisites

The first Terraform configuration lesson

Step-by-Step Guide

Step 1: Declare input variables

A variable has a name and optionally a type, description, default, and validation rules. Always give variables a type and a description. Validation lets you reject bad values early with a clear message, before any change is planned.

variable "environment" {
  type        = string
  description = "Deployment environment name"
  default     = "dev"

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "greeting" {
  type        = string
  description = "Text written into the greeting file"
  default     = "Hello"
}

Step 2: Use locals for computed names

Locals name an expression so you do not repeat it. Use them sparingly, for values you genuinely compute from other values, and reference them as local.NAME.

locals {
  file_name = "greeting-${var.environment}.txt"
}

resource "local_file" "greeting" {
  filename = "${path.module}/${local.file_name}"
  content  = "${var.greeting} from ${var.environment}!\n"
}

Step 3: Expose results with outputs

Outputs print values after apply and let other configurations read them. Give each output a description, and read one later with terraform output. The raw option prints a plain string with no quotes, handy in scripts.

output "file_path" {
  description = "Where the greeting file was written"
  value       = local_file.greeting.filename
}

# terraform output
# terraform output -raw file_path

Step 4: Set variable values and know the precedence

Values can come from a terraform.tfvars file, which loads automatically, from files ending in .auto.tfvars, from the -var and -var-file command-line options, and from environment variables named TF_VAR_name. Later sources override earlier ones, with command-line options winning over files, and files winning over environment variables and defaults. On Windows, PowerShell quoting of -var can be awkward, so prefer a tfvars file.

# terraform.tfvars
environment = "staging"
greeting    = "Welcome"

# or on the command line:
# terraform apply -var="environment=prod"
# export TF_VAR_environment=prod

Step 5: Handle sensitive values carefully

Marking a variable or output sensitive hides it in plan and apply output, but it is still stored in the state file in plain text. Never commit tfvars files that contain secrets. Pass secrets through environment variables or a secrets manager, and protect the state accordingly, which the next lesson covers.

variable "api_token" {
  type        = string
  description = "Token for an external service"
  sensitive   = true
}

FAQs

Why does my sensitive value still appear somewhere?: The sensitive flag only redacts command output. The value is stored in state, and some commands print sensitive outputs when you ask for them by name, so treat state and plan files as secret material.
What is the difference between a variable and a local?: A variable is an input that callers can set. A local is an internal named expression that cannot be set from outside. Use variables for the interface and locals for tidiness.

Summary

Use typed, described, validated variables for inputs, locals for computed names, and outputs for results. Know the value precedence, keep secrets out of version control, and remember that sensitive values still live in state.