Assigning Variable Values and Understanding Precedence

After you declare variables in a Terraform configuration, you have multiple ways to supply values. Terraform uses a layered precedence model so you can choose the most appropriate method for development, CI/CD, or production deployments. Think of the assignment methods like layers of an onion: each layer represents a different mechanism for providing a value, and layers closer to the core have higher priority. This model exists because real-world infrastructure workflows are diverse — local testing, automated pipelines, and production operations often require different handling for the same variable. Common scenarios:

Developers may need quick command-line overrides while testing locally.
CI/CD pipelines often inject values via environment variables or secret stores.
Production teams typically keep environment-specific values in version-controlled .tfvars files (or secure secret backends).

In this article we cover four primary methods to assign Terraform variable values, in rough order from lowest to highest precedence:

Variable defaults (in the variable block)
Environment variables (prefixed with TF_VAR_)
Terraform variable files (.tfvars, .auto.tfvars, .tfvars.json)
Command-line flags (-var / -var-file)

Each approach has trade-offs; read the best-practice guidance for each below.

1) Variable defaults

Default values in the variable block provide a baseline or sensible factory setting. They ensure variables have valid values when no other source supplies them. Example:

variable "pub_subnet_ids" {
  type    = set(string)
  default = ["subnet-12345", "subnet-67890"]
}

When to use defaults:

For safe development or demo values.
To document expected inputs and types.
For optional settings where a reasonable fallback exists.

Best practices:

Avoid placing secrets (API keys, passwords) in defaults.
Use defaults for non-sensitive convenience values only.
Remember defaults have the lowest priority and are easily overridden.

2) Environment variables

Terraform maps environment variables prefixed with TF_VAR_ to Terraform variables of the same name (after removing the prefix). Environment variables are a common pattern for CI/CD and secret injection. Unix shell examples:

export TF_VAR_vsphere_network="10.0.5.0/24"
export TF_VAR_vm_image="image-x3f83j2sv3"
export TF_VAR_enable_logging=true
export TF_VAR_subscription_id="abcd-1234-cc"

PowerShell examples:

$Env:TF_VAR_vsphere_network = "10.0.5.0/24"
$Env:TF_VAR_vm_image        = "image-x3f83j2sv3"
$Env:TF_VAR_enable_logging  = "true"
$Env:TF_VAR_subscription_id = "abcd-1234-cc"

Advantages:

Not checked into version control when set in the environment or CI secret stores.
Easy to rotate and scope to sessions or pipeline runs.
Integrates well with secret managers and pipeline-level secrets.

Avoid committing secrets into configuration files. Use environment variables, secure secret stores, or dedicated secret backends for credentials and API keys.

3) Terraform variable files (`.tfvars`)

.tfvars files provide a simple place to declare multiple variable values in one file. Terraform automatically loads terraform.tfvars, terraform.tfvars.json, and any *.auto.tfvars (or *.auto.tfvars.json) files in the working directory. Other .tfvars files must be specified explicitly with -var-file. Example terraform.tfvars / dev.tfvars:

# VM-level configurations
vsphere_network = "10.0.5.0/24"
vm_image        = "image-x3f83j2sv3"

# Application configurations
enable_logging = true

# Cloud account configurations
subscription_id = "abcd-1234-cc"

Best practices:

Organize variables by purpose and add comments for clarity.
Maintain environment-specific files (for example: dev.tfvars, staging.tfvars, prod.tfvars) and pass them with -var-file.
Add any .tfvars that contain secrets to .gitignore, or use a secrets manager instead.
Use *.auto.tfvars files cautiously — they auto-load, which may be helpful in simple projects but can surprise in complex workspaces.

4) Command-line flags (`-var` and `-var-file`)

Command-line -var and -var-file provide the highest precedence. Use them for quick overrides, temporary testing, or when automation passes values explicitly. Examples:

terraform plan -var="enable_logging=true"

terraform apply -var="region=us-west-2" -var="vm_image=image-x3f83j2sv3"

Notes:

-var and -var-file override values from .tfvars, environment variables, and defaults.
These flags are ideal for ephemeral changes or diagnostics.
For reproducible runs, capture the exact -var-file used in deployment scripts or CI definitions.

Order of precedence

Terraform resolves values with a defined priority. From highest to lowest precedence:

Command-line flags (-var and -var-file)
Environment variables (prefixed with TF_VAR_)
terraform.tfvars and other *.tfvars files (including *.auto.tfvars)
Variable block defaults

This hierarchy lets you design a predictable override strategy across environments.

Priority	Method	When to use
1	Command-line (`-var`, `-var-file`)	Temporary overrides, troubleshooting, CI steps that explicitly inject values
2	Environment variables (`TF_VAR_`)	Secure injection from CI/CD systems or local session-scoped secrets
3	`.tfvars` / `*.auto.tfvars`	Environment-specific configurations committed or passed as files
4	Variable defaults	Safe fallbacks, documentation, and non-sensitive defaults

An infographic titled “Order of Precedence” that shows Terraform’s variable priority from highest to lowest: Command Line Flags, *.auto.tfvars files, *.tfvars files, Environment Variables, and Variable Block Defaults. The left side lists benefits like flexibility for values, clear override rules, and adaptability across environments, with HashiCorp Terraform branding.

Design a strategy: keep secrets out of version control, use .tfvars for environment configuration, inject secrets via environment variables or a secret backend, and use -var for ad-hoc overrides. Document which method your team uses so deployments remain predictable and auditable.

Links and references

With these methods and the precedence rules in mind, you can select the most appropriate variable assignment mechanism for each Terraform project — balancing security, convenience, and reproducibility.

Course Introduction

Preparing Your Environment

Terraform Foundations

The Core Terraform Workflow

Terraform CLI

Terraform File Structure and Organization

Terraform Configuration - Fundamentals

Understading and Managing Terraform State

Marking Code Reusable

Refactoring Terraform State

Terraform Modules

Managing Resource Behavior and Dependencies

Securing Terraform Configurations

Terraform Troubleshooting

HCP Terraform

Assigning Variable Values and Understanding Precedence

1) Variable defaults

2) Environment variables

3) Terraform variable files (`.tfvars`)

4) Command-line flags (`-var` and `-var-file`)

Order of precedence

Links and references

Watch Video

​1) Variable defaults

​2) Environment variables

​3) Terraform variable files (.tfvars)

​4) Command-line flags (-var and -var-file)

​Order of precedence

​Links and references

Watch Video

1) Variable defaults

2) Environment variables

3) Terraform variable files (`.tfvars`)

4) Command-line flags (`-var` and `-var-file`)

Order of precedence

Links and references