How to Build a Terraform Reusable Module

When to create a module

Copy-paste in Terraform is a common starting point: you need three services, so you write three identical resource blocks and swap the name. It works until you need to add a fourth, or change a setting in all three, or debug which paste is the canonical one.

The rule of thumb: if you have the same resource pattern repeated two or more times with only a few values changing, extract it into a module.

Module directory layout

A module is nothing more than a directory containing .tf files. By convention it has three files:

modules/service/
  variables.tf   # inputs the caller provides
  main.tf        # the actual resources, using var.*
  outputs.tf     # values the caller can read back

variables.tf - declare the inputs

variable "name" {
  description = "Service name (used in the config file path)"
  type        = string
}

variable "enabled" {
  description = "Whether the service is enabled"
  type        = bool
  default     = true
}

main.tf inside the module - use var.*

Inside the module every reference to the caller-provided values goes through var.:

resource "local_file" "config" {
  content  = "service=${var.name}\nenabled=${var.enabled}\n"
  filename = "/tmp/config-${var.name}.conf"
}

resource "null_resource" "marker" {
  triggers = {
    config = local_file.config.content
  }
}

outputs.tf - expose values to the root

output "config_path" {
  description = "Path to the generated config file"
  value       = local_file.config.filename
}

Root main.tf - call the module three times

The root module shrinks to three small module blocks. Each call passes a different name; everything else is encapsulated inside ./modules/service:

module "api" {
  source = "./modules/service"
  name   = "api"
}

module "worker" {
  source = "./modules/service"
  name   = "worker"
}

module "scheduler" {
  source = "./modules/service"
  name   = "scheduler"
}

Re-run terraform init after creating the module directory - Terraform caches module sources and won't pick up new ones without a fresh init. The plan output will show resources namespaced under the module call: module.api.local_file.config, module.worker.null_resource.marker, and so on. The resource count stays the same; only the addresses change.

Reading a module output from the root

output "api_config_path" {
  value = module.api.config_path
}

The root references module.<call_name>.<output_name>. This is how modules expose their internals selectively - the caller sees only what outputs.tf declares.