Terraform · Infrastructure as code

What are outputs used for?

Easyoutputsmodule interfacestateUpdated Oct 2026
Quiz this track

Short answer

Outputs expose values from a module or root configuration. They form the module interface and can be consumed by other configurations through remote state, but sensitive outputs still land in state.

An output gives a name to a value that callers should see, such as a bucket ARN, a VPC id or a load balancer DNS name. In a child module, outputs are the only supported way to hand values back to the root module.

hcl
output "bucket_arn" {
  description = "ARN of the log bucket"
  value       = aws_s3_bucket.logs.arn
}

output "database_password" {
  description = "Initial database password"
  value       = var.db_password
  sensitive   = true
}
Sensitive outputs are redacted in CLI output but remain readable in state.

Where outputs are useful

  • Defining a stable interface for a reusable module
  • Printing connection details after apply
  • Sharing selected values with another root module via remote state
  • Feeding values into automation that reads terraform output -json

Keep output names semantic and stable. If downstream stacks read them through terraform_remote_state, renaming an output is a breaking change. Prefer explicit data sharing through a parameter store or a small module interface when many consumers depend on the same values.

Do not use outputs as a secret store. Anyone with state read access can recover a sensitive output, and older state versions may retain previous values.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1How does a child module return a value to its caller?
  2. 2What does sensitive = true actually protect?
  3. 3Why can renaming an output break another stack?
  4. 4When is remote state a poor integration mechanism?

Say it in the interview

Outputs expose selected values from a module or root configuration. In child modules they are the interface back to the caller, and at the root they are useful for automation and connection details. I mark secrets sensitive, but that only redacts display; the value is still in state. So I keep outputs minimal and stable, especially when another stack reads them.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.