Is it possible to access module state in a terraform remote state file?

Question

If a terraform script uses a module that has outputs, it's possible to access those module outputs in using the -module option for the terraform output command:

$ terraform output --help
Usage: terraform output [options] [NAME]

  Reads an output variable from a Terraform state file and prints
  the value.  If NAME is not specified, all outputs are printed.

Options:

  -state=path      Path to the state file to read. Defaults to
                   "terraform.tfstate".

  -no-color        If specified, output won't contain any color.

  -module=name     If specified, returns the outputs for a
                   specific module

  -json            If specified, machine readable output will be
                   printed in JSON format

If I store that state file in S3 or some such, I can then reference the outputs of the main script by using the terraform_remote_state data provider.

data "terraform_remote_state" "base_networking" {
  backend = "s3"
  config {
    bucket = "${var.remote_state_bucket}"
    region = "${var.remote_state_region}"
    key = "${var.networking_remote_state_key}"
  }
}

resource "aws_instance" "my_instance" {
  subnets = "${data.terraform_remote_state.base_networking.vpc_id}"
}

Is it possible to access the module outputs that are present in the state file as well? I'm looking for something like "${data.terraform_remote_state.base_networking.module.<module_name>.<output>}" or similar.

Answer 1

Yes, you can access remote state outputs from your own modules. You just need to "propagate" the outputs.

E.g., let's say you have something like this, your base_networking infrastructure, which contains a module for creating your VPC, and you want that VPC ID to be accessible via remote state:

base_networking/
  main.tf
  outputs.tf
  vpc/
    main.tf
    outputs.tf

In base_networking/main.tf you create your VPC using your base_networking/vpc module:

module "vpc" {
  source = "./vpc"
  region = "${var.region}"
  name = "${var.vpc_name}"
  cidr = "${var.vpc_cidr}"
}

In base_networking/vpc/outputs.tf in your module you have an id output:

output "id" {
  value = "${aws_vpc.vpc.id}"
}

In base_networking/outputs.tf you also have a vpc_id output that propagates module.vpc.id:

output "vpc_id" {
  value = "${module.vpc.id}"

With that you can now access vpc_id using something like:

data "terraform_remote_state" "base_networking" {
  backend = "s3"
  config = {
    bucket = "${var.remote_state_bucket}"
    region = "${var.remote_state_region}"
    key = "${var.networking_remote_state_key}"
  }
}

[...]

vpc_id = "${data.terraform_remote_state.base_networking.vpc_id}"