Terraform Cheatsheet

Variables

Use this Terraform reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Declaring Variables

# variables.tf
variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

variable "environment" {
  description = "Deployment environment"
  type        = string
  # no default = required input
}

variable "replica_count" {
  type    = number
  default = 1
}

variable "enable_monitoring" {
  type    = bool
  default = true
}

Variable Types

Type	Example value	Notes
`string`	`"us-east-1"`
`number`	`3` or `3.14`
`bool`	`true` / `false`
`list(string)`	`["a", "b"]`	ordered, same type
`set(string)`	`toset(["a", "b"])`	unordered, unique, same type
`map(string)`	`{ key = "val" }`	string keys, same-type values
`object({...})`	see below	named attributes, mixed types
`tuple([...])`	`["x", 1, true]`	positional, mixed types
`any`	anything	skip type checking

variable "tags" {
  type    = map(string)
  default = { Project = "myapp", Env = "prod" }
}

variable "db_config" {
  type = object({
    engine  = string
    version = string
    size    = number
  })
  default = {
    engine  = "postgres"
    version = "15"
    size    = 20
  }
}

variable "allowed_cidrs" {
  type    = list(string)
  default = ["10.0.0.0/8"]
}

Referencing Variables

resource "aws_instance" "web" {
  instance_type = var.instance_type
  ami           = var.ami_id
  tags          = var.tags
}

# Nested attribute access
engine_version = var.db_config.version

Setting Variable Values

Priority order (highest → lowest):

-var / -var-file CLI options — applied in command-line order, later options win (-var does not automatically beat -var-file)
*.auto.tfvars / *.auto.tfvars.json (lexical filename order, later wins)
terraform.tfvars.json
terraform.tfvars
TF_VAR_<name> environment variable
default in variable block
Interactive prompt (if nothing else provides a value)

# CLI flags
terraform apply -var="environment=prod" -var="replica_count=3"

# Var file
terraform apply -var-file="prod.tfvars"

# Environment variables
export TF_VAR_environment=prod
export TF_VAR_replica_count=3

tfvars Files

# terraform.tfvars  (auto-loaded)
environment    = "prod"
instance_type  = "t3.small"
replica_count  = 2

tags = {
  Project = "myapp"
  Owner   = "platform-team"
}

allowed_cidrs = [
  "10.0.0.0/8",
  "192.168.0.0/16",
]

# prod.tfvars  (loaded with -var-file)
environment   = "prod"
instance_type = "t3.large"

Never commit terraform.tfvars that contain secrets. Use environment variables or a secrets manager instead.

Validation

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment must be dev, staging, or prod."
  }
}

variable "replica_count" {
  type = number
  validation {
    condition     = var.replica_count >= 1 && var.replica_count <= 10
    error_message = "replica_count must be between 1 and 10."
  }
}

Sensitive Variables

variable "db_password" {
  type      = string
  sensitive = true   # redacted in plan/apply output
}

export TF_VAR_db_password="$(vault kv get -field=password secret/db)"

Nullable Variables (1.1+)

variable "image_tag" {
  type     = string
  default  = null   # callers can explicitly pass null
  nullable = true   # allows null even when a non-null default exists
}

Optional Object Attributes (1.3+)

variable "server_config" {
  type = object({
    instance_type = string
    disk_size     = optional(number, 20)   # optional with default
    monitoring    = optional(bool, false)
  })
}