Pro ยท Lesson 4 of 12

Variables, outputs, and locals

Variables are inputs. Outputs are results. Locals are names you reuse inside one module. None of them belong in state as a hiding place for secrets you then print.

Sign in to save your place.

Picture it this way

A variable is the blank on the form. A local is a nickname you use while filling the form. An output is the receipt you hand to the next module.

Variables

Declare a type. Add a description. Use validation when a bad string should fail before any cloud call. Set values with a terraform.tfvars file, TF_VAR_ environment variables, or -var. A tfvars file with real secrets should not be committed. A tfvars.example file with fake values can be.

Sensitive variables are still stored in state if a resource uses them. The sensitive flag hides them in the plan output. It does not encrypt the state file.

Outputs and locals

Outputs are the supported way for a root module, or a child module, to hand a value to someone else. Mark an output sensitive when it contains a password so the CLI redacts it. The value is still in state.

Locals compute a value once in the module. They are not inputs. Another module cannot set them. If a teammate needs to change it per environment, it is a variable.

Name Who sets it Shows up in plan
variable The caller As an input, redacted if sensitive
local This module Only as part of a resource change
output This module publishes it Yes, redacted if sensitive

Input, nickname, receipt

  1. Variable
  2. Local
  3. Output

Step 1 of 3The caller sets variables. Validation can reject them early.

Lab: reject a bad environment name

Validation runs during plan. Use a value that fails, read the error, then use dev.

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "test"], var.environment)
    error_message = "This lab allows dev or test."
  }
}

locals {
  name_prefix = "dfd-${var.environment}"
}

output "name_prefix" {
  value = local.name_prefix
}

Concept summary

Knowledge check

A variable is marked sensitive and used by a resource. Where does the value still go?

When should a value be a variable instead of a local?

What does a validation block check?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.