Output Values

# Create both project directories side by side
mkdir -p terraform-lesson-12/networking
mkdir -p terraform-lesson-12/application

# Networking project files
cd terraform-lesson-12/networking
touch versions.tf variables.tf main.tf outputs.tf .gitignore

# Application project files
cd ../application
touch versions.tf variables.tf main.tf outputs.tf .gitignore

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  # Remote backend — networking state is stored here
  # Application project reads from this same bucket to consume outputs
  backend "s3" {
    bucket         = "acme-terraform-state"           # Your state bucket name
    key            = "networking/terraform.tfstate"   # Unique key for networking state
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Project   = "acme"
      ManagedBy = "Terraform"
      Layer     = "networking"  # Identifies which infrastructure layer owns these resources
    }
  }
}

variable "region" {
  description = "AWS region for all networking resources"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "dev"
}

variable "vpc_cidr" {
  description = "CIDR block for the VPC — must be /16 to /28"
  type        = string
  default     = "10.0.0.0/16"
}

variable "public_subnets" {
  description = "Map of subnet name to CIDR block for public subnets"
  type        = map(string)
  default = {
    "public-a" = "10.0.1.0/24"  # Availability zone A
    "public-b" = "10.0.2.0/24"  # Availability zone B
  }
}

resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true  # Required for public DNS on instances

  tags = {
    Name        = "vpc-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id  # Implicit dependency on VPC

  tags = {
    Name = "igw-${var.environment}"
  }
}

# One subnet per entry in var.public_subnets map
# for_each key becomes the subnet's stable Terraform identity
resource "aws_subnet" "public" {
  for_each = var.public_subnets

  vpc_id                  = aws_vpc.main.id
  cidr_block              = each.value              # CIDR from the map value
  availability_zone       = "${var.region}${split("-", each.key)[1]}"  # Extract AZ suffix from name
  map_public_ip_on_launch = true

  tags = {
    Name = "subnet-${each.key}-${var.environment}"
    Tier = "public"
  }
}

resource "aws_security_group" "web" {
  name        = "web-sg-${var.environment}"
  description = "Security group for web tier instances"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "web-sg-${var.environment}"
  }
}

# ── VPC ─────────────────────────────────────────────────────────────────────

output "vpc_id" {
  description = "VPC ID — pass to any resource that must live in this network"
  value       = aws_vpc.main.id
}

output "vpc_cidr_block" {
  description = "VPC CIDR block — used by peering configurations and security group rules"
  value       = aws_vpc.main.cidr_block
}

# ── SUBNETS ──────────────────────────────────────────────────────────────────

output "public_subnet_ids" {
  description = "Map of subnet name to subnet ID — structured for easy lookup by name"
  # for expression iterates the for_each resource and builds a name => id map
  value = { for k, v in aws_subnet.public : k => v.id }
}

output "public_subnet_ids_list" {
  description = "List of all public subnet IDs — pass directly to load balancers and ECS"
  # values() extracts map values as a list — order is not guaranteed
  value = values({ for k, v in aws_subnet.public : k => v.id })
}

# ── SECURITY GROUPS ──────────────────────────────────────────────────────────

output "web_security_group_id" {
  description = "Web security group ID — attach to any instance serving HTTP or HTTPS traffic"
  value       = aws_security_group.web.id
}

output "web_security_group_arn" {
  description = "Web security group ARN — used in IAM policies and cross-account references"
  value       = aws_security_group.web.arn
}

# ── ENVIRONMENT METADATA ─────────────────────────────────────────────────────

output "environment" {
  description = "Environment name — consuming configurations use this for naming and tagging"
  value       = var.environment
}

output "region" {
  description = "AWS region — consuming configurations reference this for provider config"
  value       = var.region
}

# Show all outputs in human-readable format
terraform output

# Show a specific output by name
terraform output vpc_id

# Output as JSON — useful for scripting and CI pipelines
terraform output -json

# Output a specific value as raw string — no quotes, no formatting
# Use this when piping into another command
terraform output -raw vpc_id

# Access a nested value from a map output
terraform output -json public_subnet_ids | jq '."public-a"'

# ── SENSITIVE OUTPUTS ────────────────────────────────────────────────────────

output "db_connection_string" {
  description = "Database connection string — contains credentials, never log this"
  # Marked sensitive — Terraform redacts this in all terminal output
  sensitive = true
  # In a real configuration this would reference an RDS endpoint and a secret
  value = "postgresql://admin:${var.db_password}@${aws_db_instance.main.endpoint}/appdb"
}

output "internal_api_endpoint" {
  description = "Internal API endpoint — only accessible within the VPC"
  # Not sensitive — the endpoint is not a secret, just not public-facing
  sensitive = false
  value     = "http://internal-api.${var.environment}.acme.internal"
}

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  # Application state stored at a different key — separate from networking state
  backend "s3" {
    bucket         = "acme-terraform-state"
    key            = "application/terraform.tfstate"  # Different key from networking
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Project   = "acme"
      ManagedBy = "Terraform"
      Layer     = "application"  # Identifies this as the application layer
    }
  }
}

variable "region" {
  description = "AWS region — must match the networking project region"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Deployment environment — must match the networking project environment"
  type        = string
  default     = "dev"
}

variable "instance_type" {
  description = "EC2 instance type for application servers"
  type        = string
  default     = "t2.micro"
}

# Read the networking configuration's state file to get VPC and subnet IDs
# This project has zero knowledge of how the networking was built
# It only knows the output names — the networking project's public interface
data "terraform_remote_state" "networking" {
  backend = "s3"  # Same backend type as the networking project

  config = {
    bucket = "acme-terraform-state"           # Same bucket as networking backend
    key    = "networking/terraform.tfstate"   # The networking project's state key
    region = "us-east-1"
  }
}

# Reference networking outputs via data.terraform_remote_state.networking.outputs.*
# No hardcoded VPC IDs, no manual copy-paste — just references to the output names
locals {
  # Grab the VPC ID from the networking outputs
  vpc_id = data.terraform_remote_state.networking.outputs.vpc_id

  # Grab all subnet IDs as a list — pass directly to resources that need a subnet list
  subnet_ids = data.terraform_remote_state.networking.outputs.public_subnet_ids_list

  # Grab the security group ID for web instances
  web_sg_id = data.terraform_remote_state.networking.outputs.web_security_group_id
}

# EC2 instances deployed into the networking project's VPC and subnets
# This configuration has no aws_vpc or aws_subnet resources — it reuses existing ones
resource "aws_instance" "app" {
  ami                    = "ami-0c55b159cbfafe1f0"  # Amazon Linux 2 — us-east-1
  instance_type          = var.instance_type
  subnet_id              = local.subnet_ids[0]       # Deploy into first available subnet
  vpc_security_group_ids = [local.web_sg_id]         # Attach the networking security group

  tags = {
    Name        = "app-server-${var.environment}"
    Environment = var.environment
    VpcId       = local.vpc_id  # Tag shows which VPC this instance belongs to
  }

  lifecycle {
    create_before_destroy = true  # Zero-downtime replacement
  }
}

output "app_instance_id" {
  description = "EC2 instance ID of the application server"
  value       = aws_instance.app.id
}

output "app_public_ip" {
  description = "Public IP address of the application server"
  value       = aws_instance.app.public_ip
}

output "app_public_dns" {
  description = "Public DNS hostname — use this for HTTP access rather than the raw IP"
  value       = aws_instance.app.public_dns
}

# Surface which networking resources this application is using
# Useful for debugging and for any third configuration that builds on top of this one
output "networking_vpc_id" {
  description = "VPC ID consumed from the networking layer — for reference and downstream use"
  value       = data.terraform_remote_state.networking.outputs.vpc_id
}

output "networking_environment" {
  description = "Environment confirmed from the networking layer — validates config alignment"
  value       = data.terraform_remote_state.networking.outputs.environment
}

# Destroy application layer first — it depends on networking resources
cd application
terraform destroy

# Then destroy networking — no resources remain inside the VPC
cd ../networking
terraform destroy