Root and Child Modules

Scenario: Three teams copy a network stack, fix the same bug differently, and can no longer upgrade consistently.

Every Terraform directory is a module; the directory where Terraform runs is the root module. A module block calls a child module from a local path, registry, VCS, or other supported source. Inputs cross into the child through variables and supported results return through outputs. Child resources have addresses such as module.network.fakecloud_network.main.

Analogy: A module is a product assembly with a documented connector. Consumers should not need to reach inside and solder onto internal wires.

A worked configuration

module "service" {
  source = "./modules/service"
  name   = "payments"
}
output "service_endpoint" { value = module.service.endpoint }

Good boundaries follow lifecycle and ownership. A module that bundles every company resource becomes impossible to compose; a one-resource wrapper often adds no value. Encapsulate a useful capability with safe defaults and a small contract.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-variables-outputs-modules Terraform lab. Open /labs/terraform and choose slug tf-variables-outputs-modules; the lab runs real Terraform against the offline FakeCloud provider.