Terraform state and modules explained

Calling a local network module

The caller supplies an input and consumes a module output. The module’s internal resources stay behind a deliberate interface.

module "network" {
  source = "./modules/network"
  cidr_block = "10.0.0.0/16"
}

output "vpc_id" { value = module.network.vpc_id }

State connects code to cloud resources

Terraform uses state to map a configuration address to a real cloud object. It can include IDs, generated values, and sensitive details. Whoever can change state can affect how Terraform manages infrastructure.

Remote state gives a team one source of truth. Use encryption, least-privilege access, locking, backups, and a recovery process before depending on it in a shared environment.

Modules create useful interfaces

A module is a directory of Terraform called by another configuration. A network module might accept a CIDR block and output a network ID; the caller should not need to know every internal resource.

Extract a module only after the pattern is clear. Reuse is helpful when it removes repetition while keeping sensible, understandable defaults.

Change module contracts deliberately

A changed module input or output can affect many callers. Version modules, document breaking changes, and inspect plans for each environment that consumes the change.

Avoid using remote state as an informal connection between unrelated systems. Prefer clear module outputs and deliberate interfaces.

Put it into practice

Sketch a network module with two inputs and two outputs. Explain what callers need to know and what implementation detail should stay inside.

1. Store shared state remotely with locking.
2. Treat state access as production access.
3. Extract a module from a pattern you already understand.
4. Keep module inputs and outputs small and documented.