Reuse code with modules

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Use and version modules

Know where modules come from

The source argument tells Terraform where to get the module.

Source	Example
Local folder	`source = "./modules/network"`
Terraform Registry	`source = "Azure/avm-res-network-virtualnetwork/azurerm"`
Private registry (HCP Terraform)	`source = "app.terraform.io/ORG/network/azurerm"`
Git	`source = "git::https://github.com/s0sta/tf-modules.git//network?ref=v1.2.0"`
HTTP / S3 / GCS	Archives from a URL or bucket

$terraform init
$terraform get -update

8.2

Call a module

A module block gives the module's input variables and reads its outputs.

main.tf

module "network" {
  source        = "./modules/network"
  name          = "vnet-shop-${var.env}"
  address_space = ["10.30.0.0/16"]
  subnets = {
    web = "10.30.1.0/24"
    app = "10.30.2.0/24"
  }
  tags = local.tags
}
 
resource "azurerm_network_interface" "web" {
  # ...
  ip_configuration {
    name                          = "ipconfig1"
    subnet_id                     = module.network.subnet_ids["web"]
    private_ip_address_allocation = "Dynamic"
  }
}

8.3

Write a module

A good module has a clear interface: variables.tf (inputs), main.tf (resources), outputs.tf (results), versions.tf (providers), and a README.

modules/network/outputs.tf

output "vnet_id" {
  value = azurerm_virtual_network.this.id
}
 
output "subnet_ids" {
  value = { for k, s in azurerm_subnet.this : k => s.id }
}

8.4

Understand variable scope

A module sees only its own variables and locals. It can not read var. of the caller. Everything must be passed in as inputs, and comes back only through outputs.

From	To	How
Root module	Child module	Module arguments (`name = …`)
Child module	Root module	`module.NAME.OUTPUT`
Child A	Child B	Through the root: `module.a.x` as input of `module "b"`

Exam tip

Resources inside a module are addressed as module.network.azurerm_virtual_network.this in state commands.

8.5

Pin module versions

Registry modules use version; Git modules use ?ref=TAG. Pin them, and upgrade on purpose.

main.tf

module "vnet" {
  source  = "Azure/avm-res-network-virtualnetwork/azurerm"
  version = "~> 0.8"
  # ...
}

$terraform init -upgrade

Remember

version works only for registry modules. For Git sources, the version is in the URL (?ref=v1.2.0).

At work

Review public modules before you use them: read the code, the open issues and how often it is updated. A module runs with the rights of your pipeline.

All commands in this chapter