How to pass terraform outputs variables into ansible as vars_files?

Question

I am provisioning AWS infrastructure using terraform and want to pass variables such as aws_subnet_id and aws_security_id into ansible playbook using vars_file (don't know if there is any other way though). How can I do that?

Answer 1

I use Terraform local_file to create an Ansible vars_file. I add a tf_ prefix to the variable names to make it clear that they originate in Terraform:

# Export Terraform variable values to an Ansible var_file
resource "local_file" "tf_ansible_vars_file_new" {
  content = <<-DOC
    # Ansible vars_file containing variable values from Terraform.
    # Generated by Terraform mgmt configuration.

    tf_environment: ${var.environment}
    tf_gitlab_backup_bucket_name: ${aws_s3_bucket.gitlab_backup.bucket}
    DOC
  filename = "./tf_ansible_vars_file.yml"
}

Run terraform apply to create Ansible var_file tf_ansible_vars_file.yml containing Terraform variable values:

# Ansible vars_file containing variable values from Terraform.
# Generated by Terraform mgmt configuration.

tf_environment: "mgmt"
tf_gitlab_backup_bucket_name: "project-mgmt-gitlab-backup"

Add tf_ansible_vars_file.yml to your Ansible playbook:

  vars_files:
    - ../terraform/mgmt/tf_ansible_vars_file.yml

Now, in Ansible the variables defined in this file will contain values from Terraform.

Obviously, this means that you must run Terraform before Ansible. But it won't be so obvious to all your Ansible users. Add assertions to your Ansible playbook to help the user figure out what to do if a tf_ variable is missing:

- name: Check mandatory variables imported from Terraform
  assert:
    that:
      - tf_environment is defined
      - tf_gitlab_backup_bucket_name is defined
    fail_msg: "tf_* variable usually defined in '../terraform/mgmt/tf_ansible_vars_file.yml' is missing"

UPDATE: An earlier version of this answer used a Terraform template. Experience shows that the template file is error prone and adds unnecessarily complexity. So I moved the template file to the content of the local_file.