Modules and lookups

Every module and lookup has the same shape. Learn it once and every one of them reads the same.

One input: a map

A module takes a single input named after its resource in the plural, such as resource_groups or storage_accounts. It is a map: each entry creates one resource, and the key is a name you choose.

inputs = {
  storage_accounts = {
    logs = {
      name                     = "stlogsprod"
      resource_group_name      = "rg-app-prod"
      location                 = "uksouth"
      account_tier             = "Standard"
      account_replication_type = "ZRS"
    }
    data = {
      name                     = "stdataprod"
      resource_group_name      = "rg-app-prod"
      location                 = "uksouth"
      account_tier             = "Standard"
      account_replication_type = "GRS"
    }
  }
}

Every attribute the provider accepts is there, with its type. Required attributes are required, optional ones are optional(), and nested blocks are nested objects. Many of the provider’s own checks, such as a name’s length or a list of allowed values, are built into the input too, so those mistakes show when you plan rather than half way through an apply.

Outputs: maps keyed the same way

Each attribute comes back as a map keyed by your entry keys. With the example above, storage_accounts_id["logs"] is the ID of the first account and storage_accounts_primary_blob_endpoint["data"] the blob endpoint of the second. Sensitive attributes are marked sensitive.

Lookups

A lookup reads existing resources through the provider’s data source, with the same map input and the same keyed outputs. Use one when the resource is managed elsewhere, by another team or by hand, or when you need everything of a kind, such as every subnet in a network. A downstream unit reads a lookup’s outputs exactly as it would a module’s.

Secrets from Azure Key Vault

For azurerm, every sensitive attribute has two companion inputs, <attribute>_key_vault_id and <attribute>_key_vault_secret_name. Set them instead of the value and the module reads the secret from Key Vault, so the secret never appears in your configuration.