Exposing Configuration Data with Output Values

Welcome to this lesson on the Terraform output block. This guide explains why outputs matter, how to define them, and practical patterns to expose configuration values for humans and automation. Outputs are the structured way to retrieve important information created by Terraform—IP addresses, DNS names, connection strings, resource IDs, and other attributes you need after provisioning. They also serve as the primary mechanism for passing data between modules and integrating Terraform with automation workflows.

Outputs are useful both for immediate feedback after terraform apply and for programmatic access in CI/CD pipelines. Use outputs to avoid manual lookups in provider consoles.

When Terraform provisions resources — virtual machines, databases, storage accounts, load balancers, DNS records, and so on — you frequently need to access attributes of those resources afterward. Instead of manually hunting through a cloud provider console, declare an output to return that value and have Terraform display or store it. Example resource definitions (Azure) that might create values you want to expose:

resource "azurerm_resource_group" "prd" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_virtual_network" "dv" {
  name                = "example-network"
  resource_group_name = azurerm_resource_group.prd.name
  location            = azurerm_resource_group.prd.location
  address_space       = ["10.0.0.0/16"]
}

A purple presentation slide titled "Output Block" describing Terraform output usage, with explanatory text on the right. On the left is a framed, stylized photo of a partially open laptop lit in purple and blue.

Common output block patterns

Below are common output examples in HCL. They show how to expose a resource attribute directly and how to construct a friendly URL from resource attributes.

# Output Instance IP Address
output "instance_public_ip" {
  description = "Public IP of the web server"
  value       = aws_instance.web.public_ip
}

# Output DNS Name for Load Balancer
output "website_dns" {
  description = "DNS name of the website load balancer"
  value       = aws_elb.web_app.dns_name
}

# Output Friendly URL of Website
output "website_url" {
  description = "Friendly HTTP URL to access the website"
  value       = "https://${aws_elb.web_app.dns_name}"
}

Key points about outputs:

The output name (for example, instance_public_ip) is the identifier you reference in the CLI, automation, or module consumers.
value is the expression Terraform evaluates and stores in the state; it can be a resource attribute or a composed expression.
description is optional but recommended — it documents the purpose for other users and tools.

Use cases and examples

Resource Type	Typical output value	Example usage
Compute (VM)	Public IP or private IP	`aws_instance.web.public_ip`
Load Balancer	DNS name	`aws_elb.web_app.dns_name`
Database	Connection string or endpoint	`aws_db_instance.db.endpoint`
Storage	URL or resource ID	`azurerm_storage_account.example.primary_web_endpoint`

Outputs are stored in the Terraform state, enabling retrieval without re-running terraform apply. They are also the standard way to pass values between modules.

Inspecting and querying outputs

List all outputs from current state:

terraform output

Query a single output value:

terraform output website_url

For automation, many CI/CD systems and wrapper tools read outputs directly from the state file or use the terraform output -json flag to parse outputs programmatically:

terraform output -json

Handling sensitive outputs

If an output contains sensitive information (passwords, secrets, private endpoints), mark it as sensitive to prevent it from being printed in CLI output or exposed in logs:

output "db_password" {
  description = "RDS master password"
  value       = aws_db_instance.db.password
  sensitive   = true
}

Mark any outputs that contain secrets as sensitive = true. Sensitive outputs are suppressed from normal CLI output and help reduce accidental exposure.

Best practices

Export only values you actually need. Avoid exposing unnecessary internals from modules.
Use descriptive names and description fields for clarity.
Mark secrets as sensitive = true and manage sensitive values via secure variable sources (e.g., secret managers).
Prefer passing complex or multiple values using maps or objects when modules expect structured input/output.
Use terraform output -json for robust automation and parsing.

Quick checklist

Use outputs to expose values needed after provisioning.
Use outputs to pass data between modules.
Mark secrets as sensitive to protect confidential values.
Query outputs with terraform output or parse them with terraform output -json in automation.

Course Introduction

Preparing Your Environment

Terraform Foundations

The Core Terraform Workflow

Terraform CLI

Terraform File Structure and Organization

Terraform Configuration - Fundamentals

Understading and Managing Terraform State

Marking Code Reusable

Refactoring Terraform State

Terraform Modules

Managing Resource Behavior and Dependencies

Securing Terraform Configurations

Terraform Troubleshooting

HCP Terraform

Exposing Configuration Data with Output Values

Common output block patterns

Use cases and examples

Inspecting and querying outputs

Handling sensitive outputs

Best practices

Quick checklist

Watch Video

Practice Lab

​Common output block patterns

​Use cases and examples

​Inspecting and querying outputs

​Handling sensitive outputs

​Best practices

​Quick checklist

Watch Video

Practice Lab

Common output block patterns

Use cases and examples

Inspecting and querying outputs

Handling sensitive outputs

Best practices

Quick checklist