Supplying Values and Precedence

Scenario: A deployment uses an unexpected region because an old TF_VAR_region environment variable overrides the checked-in default.

Values can come from defaults, environment variables, automatically loaded tfvars files, explicit -var-file arguments, and -var flags, with later/higher-precedence sources winning. Exact precedence details matter during incident response. Commit non-secret examples and environment-safe defaults; keep secrets out of tfvars in version control. In automation, make the chosen variable sources explicit in run metadata.

Analogy: Variable precedence is a stack of transparent sheets. The visible value comes from the topmost sheet that writes that field; forgetting a sheet exists causes surprises.

A worked configuration

terraform plan \
  -var-file=environments/prod.tfvars \
  -var="release_id=2026-08-29"

# Environment form:
# TF_VAR_region=west

Standardize one injection pattern per pipeline. Print non-sensitive effective context before planning, and avoid personal shell variables for production runs. A .auto.tfvars file copied during debugging can silently affect every later command.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-tfvars-precedence Terraform lab. Open /labs/terraform and choose slug tf-tfvars-precedence; the lab runs real Terraform against the offline FakeCloud provider.