Terraform 1.15 Q&A: Variable-Driven Module Sources and Deprecation Support

In Terraform 1.15, HashiCorp introduces two significant enhancements: the ability to use variables directly in module sources and a formal deprecation mechanism for variables, outputs, and resources. These features streamline infrastructure management, offering greater flexibility for module authors and users alike. Here are answers to common questions about these updates.

How can I use variables in module sources with Terraform 1.15?

Terraform 1.15 allows practitioners to use variables within module sources and versions, enabling dynamic module selection based on input values. For example, you can define a variable with the new const attribute and then reference it in a module's source argument:

variable "folder" {
  type  = string
  const = true
}

module "zoo" {
  source = "./${var.folder}"
}

During terraform init, Terraform evaluates these variables and resolves the module source accordingly. If you try to reference a non-const variable or a local in the source, Terraform will report an error. This feature simplifies managing multiple module paths or versions without needing separate root configurations.

What is the const attribute and how does it work?

The const attribute is a boolean flag that you can add to a variable block. When set to true, it signals that the variable can be used during terraform init—specifically in module sources and versions. Variables marked with const cannot also use the sensitive or ephemeral attributes; they are mutually exclusive. This restriction ensures that only safe, non-secret values are used at initialization time. The variable’s value must be known before init, so you cannot use defaults that rely on other variables or functions. This makes const ideal for straightforward parameters like environment names or folder paths.

Can I use const variables in nested modules?

Yes, dynamic module sources work with nested modules, provided that each intermediate module’s input variable is explicitly declared with const = true. If a nested module receives a variable that is not marked as const, Terraform will raise an error during terraform init. This ensures that dynamic sourcing remains predictable and traceable throughout the module tree. For example, if module A uses a const variable to source module B, module B must also declare its own const input variables if they are to be used in its sources. This chain of explicit declarations prevents accidental use of dynamic sources that might change after initialization.

How do I deprecate a variable or output in a Terraform module?

Terraform 1.15 introduces the deprecated attribute for both variable and output blocks. To deprecate a variable, add a string message explaining the replacement:

variable "bad" {
  deprecated = "Please use 'good' instead, this variable will be removed"
}

Similarly, for an output:

output "old" {
  value = ...
  deprecated = "Please use 'new' instead, this output will be removed"
}

When a user references a deprecated variable or output (e.g., by passing a value to it or using it in a local), Terraform emits a warning diagnostic during validation. This gives module authors a way to communicate upcoming changes to users without breaking existing configurations immediately. The message should clearly indicate the recommended alternative.

What diagnostics are emitted when using deprecated variables or outputs?

When you use a deprecated variable or reference a deprecated output or resource, Terraform issues a warning diagnostic during validation. For variables, a warning appears if a value is passed via CLI arguments, environment variables, or other means—even if the variable is not directly used. For deprecated outputs, referencing them in locals or other outputs triggers a warning. For example, given a module with a deprecated output old, the following code will produce a diagnostic:

locals {
  moduleUsage = module.myModule.old
}

Similarly, if you mark a variable as deprecated and someone assigns it a value, they will see a warning. This helps users identify lingering references and gradually migrate to the new version. Terraform will not stop the plan or apply; it only warns, ensuring a smooth transition.

Can I reference a deprecated output inside another deprecated output?

Yes, Terraform 1.15 allows references to deprecated outputs within other outputs that are themselves marked as deprecated. This is intentional to give module authors a way to manage gradual deprecation chains. For instance:

output "old" {
  value = ...
  deprecated = "Please use 'new' instead"
}

output "ancient" {
  value = module.myModule.old
  deprecated = "Please stop using this"
}

In this case, a diagnostic warning is emitted only for the outermost deprecated output (ancient). The inner deprecated output (old) does not produce an additional warning, avoiding noise. This allows you to cascade deprecation messages without overwhelming users. However, if a user directly references module.myModule.old elsewhere, they will get its own warning.

Are there any limitations or interactions with other attributes like sensitive or ephemeral?

Yes, the const attribute cannot be used together with sensitive or ephemeral attributes. These are mutually exclusive. The reason is that const variables are intended for use during terraform init, where secrets or ephemeral values should not be exposed or stored. Marking a variable as both const and sensitive would be contradictory: a sensitive value could appear in the plan output or be used in module source paths, creating a security risk. Similarly, ephemeral values are not persistent and cannot be reliably used at init time. Therefore, if you need a variable for module sources, keep it simple and non-sensitive. For all other inputs, continue using sensitive or ephemeral as appropriate.