Terraformのremote_stateでモジュール間データを受け渡す方法｜tfstate分離設計とoutput参照の実践

この記事のポイント

・terraform_remote_stateで別tfstateのoutputを参照できる
・backendブロックのS3設定で参照先のstateを指定する
・outputにsensitive=trueで機密情報を安全に渡せる
・設計の鉄則は「一方向参照のみ」で循環参照は禁止

# ディレクトリ構成
project/
├── network/            # ネットワーク層（VPC・サブネット）
│   ├── main.tf
│   ├── outputs.tf
│   └── backend.tf
└── compute/            # コンピュート層（EC2）
    ├── main.tf
    ├── remote_network.tf   # remote_state参照
    └── backend.tf

# network/outputs.tf

output "vpc_id" {
  description = "作成したVPCのID"
  value       = aws_vpc.main.id
}

output "private_subnet_ids" {
  description = "プライベートサブネットのIDリスト"
  value       = aws_subnet.private[*].id
}

output "public_subnet_ids" {
  description = "パブリックサブネットのIDリスト"
  value       = aws_subnet.public[*].id
}

# compute/remote_network.tf

data "terraform_remote_state" "network" {
  backend = "s3"

  config = {
    bucket = "my-terraform-state-bucket"
    key    = "network/terraform.tfstate"
    region = "ap-northeast-1"
  }
}

# compute/main.tf

resource "aws_instance" "app" {
  ami           = "ami-0c1de55ac2bffeae7"  # RHEL 9
  instance_type = "t3.micro"

  # ネットワーク層のoutputからサブネットIDを取得
  subnet_id = data.terraform_remote_state.network.outputs.private_subnet_ids[0]

  vpc_security_group_ids = [aws_security_group.app.id]

  tags = {
    Name = "app-server"
  }
}

resource "aws_security_group" "app" {
  name   = "app-sg"
  # ネットワーク層のoutputからVPC IDを取得
  vpc_id = data.terraform_remote_state.network.outputs.vpc_id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

$ cd project/compute
$ terraform init
$ terraform plan

data.terraform_remote_state.network: Reading...
data.terraform_remote_state.network: Read complete after 1s

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.app will be created
  + resource "aws_instance" "app" {
      + ami                          = "ami-0c1de55ac2bffeae7"
      + instance_type                = "t3.micro"
      + subnet_id                    = "subnet-0a1b2c3d4e5f67890"
        ...
    }

  # aws_security_group.app will be created
  + resource "aws_security_group" "app" {
      + name   = "app-sg"
      + vpc_id = "vpc-0123456789abcdef0"
        ...
    }

Plan: 2 to add, 0 to change, 0 to destroy.

# network/outputs.tf（機密情報の例）
output "db_endpoint" {
  description = "RDSエンドポイント"
  value       = aws_db_instance.main.endpoint
  sensitive   = true
}

Error: retrieving state: NoSuchKey: The specified key does not exist.
  status code: 404, request id: xxxxxxxxxxxx
  with data.terraform_remote_state.network,
  on remote_network.tf line 1, in data "terraform_remote_state" "network":

Error: Unsupported attribute
  on main.tf line 9, in resource "aws_instance" "app":
   9: subnet_id = data.terraform_remote_state.network.outputs.private_subnets[0]

This object does not have an attribute named "private_subnets".
Did you mean "private_subnet_ids"?