Variables, locals and outputs

# Full declaration of a variable
variable "instance_type" {
  type        = string              # data type
  default     = "t3.micro"          # default value (makes the variable optional)
  description = "EC2 instance type"      # documentation
  sensitive   = false               # if true, hides the value in logs

  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium"], var.instance_type)
    error_message = "instance_type must be t3.micro, t3.small or t3.medium."
  }
}

# Variable with no default (REQUIRED — Terraform will prompt for the value)
variable "db_password" {
  type      = string
  sensitive = true
  description = "Database password"
}

# Variable with a complex type
variable "allowed_cidrs" {
  type    = list(string)
  default = ["10.0.0.0/8", "172.16.0.0/12"]
}

variable "tags" {
  type = map(string)
  default = {
    Environment = "dev"
    Team        = "platform"
  }
}

# terraform.tfvars — loaded automatically if it exists in the directory
aws_region    = "us-east-1"
instance_type = "t3.small"
db_password   = "super-secret"    # ⚠️ do not commit if it contains secrets

# prod.auto.tfvars — loaded automatically (thanks to the .auto.)
environment = "prod"
instance_type = "t3.large"       # overrides terraform.tfvars

# Reference in code: var.variable_name
resource "aws_instance" "web" {
  instance_type = var.instance_type
  ami           = var.ami_id
}

variable "db_password" {
  type      = string
  sensitive = true
}

# In the plan you will see:
# + db_password = (sensitive value)  ← value hidden in the CLI

# BUT in terraform.tfstate you will see:
# "db_password": "my-secret-password"  ← in plain text ⚠️

# That's why it's recommended to:
# 1. Use a remote backend with encryption (S3 + KMS or HCP Terraform)
# 2. Retrieve secrets from Vault/Secrets Manager at runtime

# Ephemeral variable — not written to state
variable "db_password" {
  type      = string
  ephemeral = true    # new in Terraform 1.10+
}

# Ephemeral resource — data that does not persist in state
ephemeral "aws_secretsmanager_secret_version" "db_creds" {
  secret_id = "prod/db/password"
}

# Write-only argument — accepts an ephemeral value on a resource
resource "aws_db_instance" "main" {
  identifier = "prod-db"
  engine     = "postgres"
  password   = ephemeral.aws_secretsmanager_secret_version.db_creds.secret_string
  # password has write_only = true: sent to the API but not saved in state
}

# Declaring outputs
output "vpc_id" {
  value       = aws_vpc.main.id
  description = "ID of the main VPC"
}

output "db_endpoint" {
  value       = aws_db_instance.main.endpoint
  description = "Database connection endpoint"
  sensitive   = true           # hidden in CLI, but available to parent modules
}

output "subnet_ids" {
  value       = aws_subnet.public[*].id   # list of IDs with a splat expression
  description = "IDs of the public subnets"
}

# Access from a parent module:
# module.networking.vpc_id
# module.networking.subnet_ids

# Access from the CLI:
# terraform output vpc_id
# terraform output -json

# locals block (plural: the block is called "locals")
locals {
  # Combine variables to build a standard name
  name_prefix = "${var.project}-${var.environment}"

  # Common tags applied to all resources
  common_tags = {
    Project     = var.project
    Environment = var.environment
    ManagedBy   = "terraform"
    Owner       = var.team
  }

  # Complex calculation
  is_production = var.environment == "prod"
  instance_type = local.is_production ? "t3.large" : "t3.micro"
}

# Access: local.name (singular: "local")
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-vpc"
  })
}