Reusable Module Design: The Clean Interface Contract

The Big Idea

In software engineering, you do not write an entire application in a single 10,000-line file: you break it into packages, classes, and functions with well-defined interfaces. The exact same architectural principle applies to Terraform through Modules.

A Terraform module is simply a directory containing .tf files. Every project has at least one module (the root module). Child Modules are reusable components that encapsulate complex infrastructure patterns, like a hardened VPC, an EKS cluster, or a secure RDS database.

The key to elite module design is treating the module as an immutable public API: variables.tf defines the inputs, outputs.tf defines the exported outputs, and main.tf contains private implementation details that callers do not need to understand.

Enterprise Module Structure & Consumer Invocation

# Standard Module Directory Layout:
# modules/aws-secure-vpc/
# ├── README.md       # Human documentation and architecture diagrams
# ├── versions.tf     # Required terraform and provider versions
# ├── variables.tf    # Inputs, constraints, and validation
# ├── main.tf         # Resource declarations
# └── outputs.tf      # Exported attributes (VPC ID, Subnets)

# In Consumer Root Module: main.tf
module "production_vpc" {
  # Remote git source pinned to an exact immutable release tag
  source = "git::https://github.com/myorg/terraform-aws-vpc.git?ref=v1.4.0"

  vpc_cidr            = "10.200.0.0/16"
  environment         = "production"
  enable_nat_gateway  = true
  single_nat_gateway  = false # Multi-AZ High Availability
  availability_zones  = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

# Consume module outputs directly in downstream resources
resource "aws_security_group" "app" {
  name   = "app-firewall"
  vpc_id = module.production_vpc.vpc_id # Module output reference
}