In Terraform, what does an `output` block do, and how does a calling configuration read an output declared in a child module?

## What an output block is An `output` block declares a named value that a Terraform module makes visible outside itself. It is the module's *return value*. The block takes one required argument, `value` — any expression — plus optional `description`, `sensitive`, and `depends_on`. ```hcl output "vpc_id" { description = "ID of the VPC created by this module" value = aws_vpc.main.id } ``` Declaring an output changes nothing about the infrastructure. It does add an edge to Terraform's dependency graph — the output cannot be resolved until `aws_vpc.main` is known — but it neither creates, protects, nor refreshes anything. ## Why the boundary needs it Inside a single module, resources address each other directly: `aws_subnet.private.id`, `aws_instance.web.private_ip`. Those addresses are *module-local*. A parent configuration cannot reach into a child and write `module.network.aws_vpc.main.id` — that address does not exist. The module's resources are encapsulated, and the only names that cross the boundary are the outputs it declares. This is exactly the encapsulation you get from a function: the internals are private, the returned values are public. ## Root outputs versus child outputs The same block behaves differently depending on where it sits. **Root module outputs** are the human and CLI surface. Terraform prints them at the end of a successful `apply`, records them in state, and `terraform output` (or `terraform output <name>`) reads them back later without re-running anything. They are how you answer "what is the load balancer's DNS name?" after the fact. **Child module outputs** are the programmatic interface. They are *not* printed after `apply` — a common surprise. The caller consumes them by module address: ```hcl module "network" { source = "./modules/network" } resource "aws_instance" "app" { subnet_id = module.network.private_subnet_id } ``` The label after `module` in the address is the *block* label in the caller (`network`), not the directory name. If you want a child's value on the terminal, the root module must re-export it with its own output block whose `value` is `module.network.private_subnet_id`. ## Values that are not known yet At plan time an output whose value derives from an attribute the provider has not assigned yet renders as `(known after apply)`. That is normal for anything the cloud allocates — IDs, ARNs, generated DNS names. It only becomes a problem when something that must be resolvable during planning, such as a `for_each` key set, depends on it. ## Practical conventions - **Export the smallest useful thing.** An output returning the whole resource object (`value = aws_vpc.main`) couples callers to every attribute and silently widens the interface; exporting `aws_vpc.main.id` keeps the contract narrow. - **Always write `description`.** It is the module's API documentation and is surfaced by tooling that reads the configuration. - **Treat outputs as a public contract.** Renaming or deleting an output is a breaking change for every caller, even though it destroys nothing. - **`depends_on` on an output** is a rare escape hatch: it makes the output wait for a resource that the value expression does not reference, so a caller that consumes the output also waits. Reach for it only when an implicit dependency genuinely does not exist. - **Outputs are recorded in state.** Adding or changing one shows up in the plan as a change to output values even when no resource changes. ## What outputs are not They are not variables — `variable` blocks are inputs, flowing in from the caller; outputs flow out. They are not a way to pass values between separate configurations that have their own state; that requires reading the other configuration's state or a shared data store, which is a different topic. And they are not a place to compute intermediates for internal use — a value only the module itself consumes belongs in the module's own expressions rather than on its public surface.