1. Default values
2. terraform.tfvars or *.tfvars
3. Environment variables
4. Command line
5. Prompt
6. .auto.tfvars or .auto.tfvars.json

1. Default values

Create a file called variables.tf and define all the commonly used variables there.

variable "aws_region" {
  description = "The AWS region to deploy resources into"
  type        = string
  default     = "us-east-1"
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

You can use these variables in main.tf (or any other .tf file) with var.<variable_name>.

# main.tf
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = var.instance_type
}

Default values get committed to Git with the code, so don't put any sensitive information here.

2. terraform.tfvars

If you put values in terraform.tfvars, Terraform loads them automatically. Don't put sensitive information in this file.

Even if we declare the variable in terraform.tfvars, in order to use that value we still need a matching variable declaration in variables.tf.

# terraform.tfvars
instance_type = "t3.medium"

# variables.tf
variable "instance_type" {
  description = "EC2 instance type"
  type        = string
}

In main.tf we can refer to the variable like this:

# main.tf
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = var.instance_type
}

If you have multiple environments like Dev1, Dev2, SIT1, SIT2, and Prod, you usually keep a separate variables file for each one, like dev1.tfvars, dev2.tfvars, and prod.tfvars.

Terraform won't read these files automatically. You must pass the file name when you run the command:

terraform plan -var-file=dev1.tfvars
terraform apply -var-file=prod.tfvars

3. Environment variables

export TF_VAR_instance_type="t3.small"   # to set
unset TF_VAR_instance_type               # to unset

terraform plan   # instance_type = t3.small

• Environment variables can leak through shell history, CI logs, or env dumps in debug output.
• They don't show up in code, so it's easy to forget one is set and get an unexpected value.

4. Command line

terraform plan -var="instance_type=c5.xlarge"

5. Prompt

If you declare a variable without a default value and don't provide it anywhere else, Terraform asks you for it at runtime.

$ terraform plan
var.instance_type
  Enter a value:

6. .auto.tfvars or .auto.tfvars.json

Terraform loads any file ending in .auto.tfvars or .auto.tfvars.json automatically, the same way it loads terraform.tfvars. You don't need to pass a flag.

Which one takes precedence?

Terraform loads values in this order, with the last one winning:

1. Default values (lowest)
2. Environment variables (TF_VAR_)
3. terraform.tfvars
4. terraform.tfvars.json
5. *.auto.tfvars / *.auto.tfvars.json in alphabetical order
6. -var and -var-file on the command line (highest)

So the command line always wins.

Terraform only prompts you if the variable has no value from any other source.

Note on sensitive values

Even if a variable is marked as sensitive = true, Terraform still stores its value in terraform.tfstate as plain text. So don't commit the state file to Git, and keep secrets out of your variable files.

Content coming soon.

Content coming soon.

Content coming soon.