Chapter 33: Terraform Providers Resources Variables Outputs Locals and Data Sources

33.4 Outputs — values you hand to people and other tools

By Ravindra Bagale · Last updated: 25 October 2026

Story. After an Infosys client deployment, the tester always asked the same question: what is the URL? Hunting for it in the console wastes time and invites mistakes. Outputs print chosen values after apply and store them in state. Jenkins, Ansible and other Terraform projects can then read them without anyone copying text by hand.

output "web_url" {
  value       = "http://${aws_instance.web.public_dns}"
  description = "Open this in a browser"
}

output "db_password" {
  value     = random_password.db.result
  sensitive = true
}

terraform output
terraform output -raw web_url
terraform output -json > outputs.json

What each line does

• output "web_url" { — Declares an output named web_url.
• value = "http://${aws_instance.web.public_dns}" — Builds a URL by inserting the instance DNS name into a string.
• description = "..." — Explains the output to the reader.
• output "db_password" { — A second output holding a generated password.
• sensitive = true — Hides the value in plan and apply output; it is still stored in state.
• terraform output — Lists every output after apply.
• terraform output -raw web_url — Prints only the value with no quotes, ready for scripts.
• terraform output -json > outputs.json — Writes all outputs as JSON for another tool.

When it is green.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

db_password = <sensitive>
web_url = "http://ec2-203-0-113-25.ap-south-1.compute.amazonaws.com"

When it is red.

Error: Output refers to sensitive values
  on outputs.tf line 6:
To reduce the risk of accidentally exporting sensitive data, set sensitive = true.

Fix. An output reads a sensitive value. Add sensitive = true to the output, and treat the state file as secret because it holds the real value.

What: every term in plain English

• output block — output "NAME" { value = ... }. A value printed after apply and saved in state.
• terraform output — Prints all outputs from state.
• -raw — Prints one string with no quotes. Good for scripts.
• -json — Prints all outputs as JSON. Good for jq and tools.
• sensitive output — Hidden in the summary. Shown only when you ask for it by name.
• terraform_remote_state — A data source that reads outputs of another state.

Example 1: Print the URL after apply

A tester at Infosys always asked: what is the URL? Now apply prints it.

output "web_url" {
  description = "Open this in a browser"
  value       = "http://${aws_instance.web.public_ip}"
}

output "instance_id" {
  value = aws_instance.web.id
}

terraform apply -auto-approve
terraform output
terraform output -raw web_url

Output

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:
instance_id = "i-0123456789abcdef0"
web_url = "http://13.233.10.20"

instance_id = "i-0123456789abcdef0"
web_url = "http://13.233.10.20"
http://13.233.10.20

What it shows: Adding outputs is a no-cost apply. Nothing in AWS changes.

Example 2: Use outputs in a script

A Swiggy-style Jenkins job runs a smoke test right after apply. It reads the URL with -raw.

#!/usr/bin/env bash
set -euo pipefail
URL=$(terraform output -raw web_url)
for i in 1 2 3 4 5 6; do
  if curl -fs "$URL" > /dev/null; then echo "UP: $URL"; exit 0; fi
  echo "waiting... ($i)"; sleep 10
done
echo "DOWN: $URL"; exit 1

Output

waiting... (1)
waiting... (2)
UP: http://13.233.10.20

What it shows: Without -raw the value has quotes and curl would fail.

Example 3: JSON outputs for Ansible inventory

A Flipkart-style team builds servers with Terraform and configures them with Ansible. Outputs become the inventory.

output "web_ips" {
  value = aws_instance.web[*].public_ip
}

terraform output -json web_ips
terraform output -json web_ips | jq -r '.[]' | sed '1i [web]' > inventory.ini
cat inventory.ini

Output

["13.233.10.20","13.233.10.21"]
[web]
13.233.10.20
13.233.10.21

What it shows: The [*] splat gives a list from count resources.

Example 4: Read outputs from another stack

A Zomato-style team has a network stack and an app stack with separate state in S3. The app reads the VPC id from the network outputs.

# network stack: outputs.tf
output "vpc_id" {
  value = aws_vpc.main.id
}
output "public_subnet_ids" {
  value = aws_subnet.public[*].id
}

# app stack: main.tf
data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "company-tf-state"
    key    = "network/dev/terraform.tfstate"
    region = "ap-south-1"
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.al2023.id
  instance_type = "t3.micro"
  subnet_id     = data.terraform_remote_state.network.outputs.public_subnet_ids[0]
}

cd network && terraform apply -auto-approve && cd ..
cd app && terraform init && terraform plan | grep subnet_id

Output

Outputs:
public_subnet_ids = ["subnet-0aaa1111bbbb2222c", "subnet-0ddd3333eeee4444f"]
vpc_id = "vpc-0123abcd4567ef890"

      + subnet_id = "subnet-0aaa1111bbbb2222c"

What it shows: The app role needs read access to the network state file. If that is too much access, share through SSM parameters instead (see 33.6).

Example 5: Sensitive output

A Razorpay-style team outputs the DB endpoint and a generated password for the app team. The password must not print in CI logs.

resource "random_password" "db" {
  length  = 20
  special = false
}

output "db_password" {
  value     = random_password.db.result
  sensitive = true
}

terraform apply -auto-approve
terraform output
terraform output -raw db_password | wc -c

Output

Outputs:
db_password = <sensitive>

20

What it shows: We only count characters here, so the secret never shows on screen. Prefer Secrets Manager for real passwords.

Command cheat sheet

Verify: did it work?

1. Outputs exist

   terraform output
   

   Output

   web_url = "http://13.233.10.20"
   

2. Script-friendly

   terraform output -raw web_url
   

   Output

   http://13.233.10.20
   

3. Secret hidden

   terraform output db_password
   

   Output

   <sensitive>
   

When it is red 1

Error: Output refers to sensitive values
  on outputs.tf line 1: output "db_password"
To reduce the risk of accidentally exporting sensitive data ... the output value must be marked as sensitive.

Cause. The value comes from a sensitive source.

Fix, step by step

1. Add sensitive = true to the output.

When it is red 2

Warning: No outputs found

Cause. State has no outputs yet, or you are in the wrong folder or workspace.

Fix, step by step

1. Run apply after adding outputs.
2. Check terraform workspace show.

When it is red 3

curl: (3) URL using bad/illegal format or missing URL

Cause. You used terraform output without -raw, so the value had quotes.

Fix, step by step

1. Use terraform output -raw web_url.

Cleanup

terraform destroy -auto-approve
rm -f inventory.ini

Practice tasks

Homework: try at home

Recap

• Outputs print after apply and live in state.
• -raw for scripts, -json for tools.
• Splat [*] gives lists from count.
• Sensitive outputs are hidden in the summary.
• Outputs are how stacks and tools share values.

FAQ

Do outputs cost money?

No. They are values in state.

Is a sensitive output safe?

Hidden on screen, but stored in state. Protect state.

Can modules have outputs?

Yes. The caller reads module.NAME.OUTPUT.

Do I need apply to see a new output?

Yes. apply writes it to state, even with no AWS change.

Can I read outputs from another folder?

Yes, with terraform_remote_state or -chdir.

Why does my output show (known after apply)?

The value, such as a new IP, only exists after AWS creates the object. Run apply, then terraform output.

Interview questions

1. What are outputs for?

   To show values after apply and to share them with scripts, tools and other stacks.

2. -raw vs -json?

   -raw prints one string without quotes; -json prints structured data.

3. How do you hide a secret output?

   sensitive = true, and protect the state file.

4. How do two stacks share a VPC id?

   The network stack outputs it; the app stack reads it with terraform_remote_state or a data source.

5. How do you get a list of IPs from count?

   aws_instance.web[*].public_ip.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards