Is this possible to use outputs from one terraform cloud workspace as variables in another workspace?

Question

Here are further details:

Workspace-A (base stack) : This workspace has code that will create AWS: VPC, SGs, RouteTables, Subnet and related associtions etc.

Workspace-B (Service-1 Stack): This workspace has code to create AWS : ALB, some ECS containers using fargate and some other components related to this service.

Now, in above case any service (Service-1, 2 , 3 etc.) wil use the VPC/base stack created by Workspace-A, how can we use outputs from Workspace A( VPC, SGs, subnets etc.) as variables of workspace-B so that workspace-B can consume those VPC and rest of the components.

Oconnell

Answer 1

You can achieve this with the use of 'remote_state' data source and to do so, you must configure a Terraform remote backend to connect to your Terraform workspaces.

Any workspace to be able to share its state must have configured a 'outputs'.

For Workspace-A, you can configure the VPC as output -

output "vpc_id" {
  description = "The VPC ID"
  value = aws_vpc.my_vpc.id
}

After running terraform apply with Workspace-A, configure the tf file for Workspace-B as below -

data "terraform_remote_state" "vpc" {
  backend = "remote"

  config = {
    organization = "org-****"
    workspaces = {
      name = "workspace-A"
    }
  }
}

This Terraform configuration can now access the outputs from Workspace-A as -

resource "aws_instance" "foo" {
  # ...
  subnet_id = data.terraform_remote_state.vpc.outputs.subnet_id
}

P.S. - I realize it's late, but it might be useful to someone else.

Laudian

Please be cautious with this approach, as it essentially allows one workspace to access the state of another, which could expand the attack surface. Ideally, workspaces should not be granted permission to read each other’s states to maintain isolation and minimize security risks. See my reply for a safer alternative. – Refined

Answer 2

What you're looking for is Terraform Data Sources:

https://www.terraform.io/docs/configuration/data-sources.html

So instead of pass outputs from one configuration to another, the best practice is to create infrastructure in Workspace-A and then query the provider to load that infrastructure in Workspace-B.

I would recommend tagging the resources created by each Workspace in your example with a unique identifier both for general traceability and also so that you can easily look up resources created by other Terraform configurations using data sources.

Leninist

Answer 3

If a workspace has a hard dependency on another, I recommend making this dependency explicit by using HCP Terraform variable sets, which enable sharing values between workspaces. When you update a variable set, the changes automatically apply to all workspaces that use it.

Aim to model your infrastructure as code and your HCP Terraform environment similarly to how you model your cloud. For instance, just as a workload might depend on a VPC in a different account or project, you should create a dedicated workspace for the VPC. Define a variable set with values like VPC_ID and share it with the dependent workload workspace. This approach ensures dependencies are visible and well-defined, maintaining clarity and structure across your environment.

Creating a variable set:

resource "tfe_variable_set" "network" {
  name         = "network"
  description  = "Contains network/vpc related variables"
  organization = "XXXXXXXXXXXXXXX"
}

Attaching a variable to the variable set:

resource "tfe_variable" "vpc_id" {
  key             = "vpc_id"
  value           = aws_vpc.example.id
  category        = "terraform"
  variable_set_id = tfe_variable_set.network.id
}

Finally, share the variable set with another HCP Terraform workspace. This ensures that the targeted workspace receives and uses the variables:

resource "tfe_workspace_variable_set" "workload" {
  variable_set_id = tfe_variable_set.network.id
  workspace_id    = tfe_workspace.workload_xyz.id
}

Refined