Sharing Outputs with Other Teams — Without Sharing State

1. 1

   Publish ShopLite's shareable values

   A map of name → value, published with for_each. Lists are stored as StringList (comma-separated). The path includes the environment, so each environment publishes its own set.

   locals {
     published = {
       "network/vpc_id"             = { type = "String", value = module.network.vpc_id }
       "network/private_subnet_ids" = { type = "StringList", value = join(",", module.network.private_subnet_ids) }
       "security/db_sg_id"          = { type = "String", value = aws_security_group.db.id }
       "database/endpoint"          = { type = "String", value = aws_db_instance.main.address }
     }
   }
   
   resource "aws_ssm_parameter" "published" {
     for_each = local.published
   
     name        = "/${var.project}/${var.environment}/${each.key}"
     type        = each.value.type
     value       = each.value.value
     description = "Published by ShopLite Terraform for other teams. Do not edit by hand."
   }

   terminalcopy cmd

   $ ./tf dev apply

   aws ssm get-parameters-by-path --path /shoplite/dev --recursive --query 'Parameters[].[Name,Value]' --output text

   ── expected output ──

   Plan: 4 to add, 0 to change, 0 to destroy.

   ...

   /shoplite/dev/database/endpoint shoplite-dev-db.c1x2y3z4a5b6.ap-south-1.rds.amazonaws.com

   /shoplite/dev/network/private_subnet_ids subnet-0aa11bb22cc33dd44,subnet-0ee55ff66aa77bb88

   /shoplite/dev/network/vpc_id vpc-0c1d2e3f4a5b6c7d8

   /shoplite/dev/security/db_sg_id sg-0c3d4e5f607182930

2. 2

   The analytics team's configuration

   A separate root with its own state (key analytics/dev/terraform.tfstate). It reads the parameters, splits the StringList back into a list, and creates its own security group in ShopLite's VPC that the DB will accept. That last part needs a rule on ShopLite's side too, which is a deliberate, reviewable change by the owning team.

   provider "aws" {
     region = "ap-south-1"
   }
   
   data "aws_ssm_parameter" "vpc_id" {
     name = "/shoplite/dev/network/vpc_id"
   }
   
   data "aws_ssm_parameter" "private_subnet_ids" {
     name = "/shoplite/dev/network/private_subnet_ids"
   }
   
   locals {
     vpc_id             = data.aws_ssm_parameter.vpc_id.value
     private_subnet_ids = split(",", data.aws_ssm_parameter.private_subnet_ids.value)
   }
   
   resource "aws_security_group" "etl" {
     name_prefix = "analytics-etl-"
     vpc_id      = local.vpc_id
     description = "Analytics ETL jobs"
   }
   
   output "etl_security_group_id" {
     value = aws_security_group.etl.id
   }
   
   output "subnets_used" {
     value = local.private_subnet_ids
   }

   terminalcopy cmd

   $ cd ../analytics && terraform init && terraform apply

   ── expected output ──

   data.aws_ssm_parameter.vpc_id: Read complete after 0s [id=/shoplite/dev/network/vpc_id]

   data.aws_ssm_parameter.private_subnet_ids: Read complete after 0s [id=/shoplite/dev/network/private_subnet_ids]

   ...

   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

    

   Outputs:

    

   etl_security_group_id = "sg-0d4e5f6071829304a"

   subnets_used = tolist([

   "subnet-0aa11bb22cc33dd44",

   "subnet-0ee55ff66aa77bb88",

   ])

3. 3

   Compare with terraform_remote_state (don't keep it)

   For contrast, the remote-state version is shorter, but granting it means the analytics role must read shoplite/dev/terraform.tfstate, which includes the DB endpoint, every IAM ARN, and any secret that has ever been stored in state. It also only sees root OUTPUTS, so ShopLite would need to add them.

   Read-only illustration. Delete after trying.

   data "terraform_remote_state" "shoplite" {
     backend = "s3"
     config = {
       bucket = "shoplite-tfstate-c41e"
       key    = "shoplite/dev/terraform.tfstate"
       region = "ap-south-1"
     }
   }
   
   # data.terraform_remote_state.shoplite.outputs.vpc_id

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.