Pro · Lesson 6 of 12

Modules

A module is a set of files you call with inputs and read through outputs. A folder of copied files is not a module until something calls it.

Picture it this way

A module is a recipe card. The root module is the meal you are cooking tonight. You can use the same card for lunch tomorrow with different ingredients. You do not photocopy the card and then edit both copies until they disagree.

Root and child

The directory where you run terraform is the root module. A module block calls a child. The child's variables are that block's arguments. The child's outputs are module.name.output. Resources inside the child get addresses like module.network.aws_subnet.private.

A child module cannot see the caller's locals. Pass what it needs. Return what the caller needs. Hiding an id inside the child and then scraping state is how later refactors break.

Sources and versions

A source can be a local path, a git URL, or a registry. Pin a version on a registry module. An unpinned source will change. terraform init downloads modules. Commit the lock file when the module source supports one.

Do not point a production root module at a branch named main with no revision. You will apply someone else's Tuesday commit by accident.

Source	Pin it with
Local path	Code review of that folder
Git	A tag or a commit
Registry	A version argument

Call a module

Root
Module
Objects

Step 1 of 3The root is where you run plan.

Lab: a child module that only names a prefix

Two directories. The root passes environment. The child returns a name. No cloud provider.

mkdir -p modules/name
cat > modules/name/main.tf <<'EOF'
variable "environment" { type = string }
output "name" { value = "dfd-${var.environment}" }
EOF
cat > main.tf <<'EOF'
module "name" {
  source      = "./modules/name"
  environment = "dev"
}
output "name" { value = module.name.name }
EOF
terraform init
terraform console <<'EOF'
module.name.name
EOF

Concept summary

A module call passes variables in and reads outputs out.
Pin remote sources.
Resource addresses include the module name. Renames need a moved block, not a hope.

Knowledge check

How does a root module read a child's value?

Why pin a registry module version?

A child module needs the VPC id. What is the clean path?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.