Terraform: When and How to Use terraform_remote_state

When dealing with multiple Terraform configurations, it becomes essential to manage dependencies between them. This is where terraform_remote_state comes into play. In this blog post we will dive into advantages and disadvantages of terraform_remote_state and how to implement it effectively.

Understanding terraform_remote_state

terraform_remote_state is a data source that allows one Terraform configuration to access the state of another configuration. This is particularly useful in modular setups where different components of your infrastructure are managed in separate Terraform projects. In Terraform data source is a way used retrieve information from an external source and thats why terraform_remote_state is used to access the outputs of one Terraform workspace in another enabling the reuse of resources.

When to use terraform_remote_state

1. Modular Infrastructure
   Using terraform_remote_state allows modules to share resources seamlessly.

2. Multi-Environment Management:
   When managing multiple environments (e.g., development, stating, production), you may want to reference resources from one environment to another.

3. Resources Dependencies
   If one Terraform configuration depends on outputs from another.

Benefits of Using terraform_remote_state

1. Loose Coupling
   Allows different Terraform configurations to be loosely coupled, making your infrastructure more modular and easier to manage.

2. Simplicity
   Reduce complexity by providing a straightforward way to access outputs from other Terraform states.

3. Clarity
   Helps maintain clarity in your infrastructure by providing a clear dependency chain between configurations.

Downsides of Using terraform_remote_state

While terraform_remote_state offers some advantages, there are some downsides to consider.

1. Increased Complexity
   Managing multiple state files can introduce complexity, especially if the dependencies between them are not well-documented.

2. Risk of Broken References
   Changes in the source configuration (e.g., renaming outputs) can break references in the target configuration, leading to potential deployment issues.

3. Dependency Management
   It can create implicit dependencies that may not be immediately clear, making it harder to understand the overall infrastructure when multiple configurations are involved.

How to Use terraform_remote_state

1. Ensure that Terraform configuration you want to reference has its state stored remotely such as in S3 bucket:

terraform {
  backend "s3" {
    bucket = "your-terraform-state-bucket"
    key    = "network/state"
    region = "eu-central-1"
  }
}

1. In the Terraform configuration that you want to reference, define necessary output. For example it could be VPC id and subnet ids:

output "vpc_id" {
  value = aws_vpc.main.id
}

output "subnet_ids" {
  value = aws_subnet.main[*].id
}

1. In your target Terraform configuration (where you want to use outputs), define a terraform_remote_state data source to access the outputs from the first configuration:

data "terraform_remote_state" "network" {
  backend = "s3"

  config = {
    bucket = "your-terraform-state-bucket"
    key    = "network/state"
    region = "eu-central-1"
  }
}

1. Now you can reference the output from the remote state your current configuration:

resource "aws_instance" "web" {
  ami                    = "ami-12345678"
  instance_type          = "t2.micro"
  subnet_id              = data.terraform_remote_state.network.outputs.subnet_ids[0]
  vpc_security_group_ids = [data.terraform_remote_state.network.outputs.security_group_id]
}

Important: while terraform_remote_state provides a convenient way to reference state outputs from different configurations, it's important to be aware of the security implications. The state snapshot data is treated as a single object. This means that user with enough permissions to access output values will also have access to the entire state snapshot.

Beside sensitive data exposure, relying on terraform_remote_state can create tight coupling between modules (configurations), making them less independent and harder to manage.

Conclusion

While terraform_remote_state can be useful for sharing state between different Terraform configurations, it's important to understand its limitations and potential risks. This data source should be used in such scenarios when there no better approach and when outputs from one configuration need to be dynamically shared with other configuration.