Terraform modules, explained

You'll build a real module and use it for two environments, then watch the moved-block trap happen for real. terraform_data, which is built in, stands in for a real network.

You need: Terraform 1.4 or newer (install guide) or OpenTofu (install guide), and a terminal. No cloud account. No cost. Everything stays on your computer.

1. Make a folder called terraform-lab with these four files

variable "name" {
  type        = string
  description = "Environment name, used as a prefix"
}

variable "cidr_block" {
  type    = string
  default = "10.0.0.0/16"
}

variable "subnet_count" {
  type    = number
  default = 2
}

# terraform_data is built into Terraform (1.4 and newer) and OpenTofu.
# Here it stands in for a real network, so the lab needs no cloud account and costs nothing.

resource "terraform_data" "network" {
  input = {
    name       = "${var.name}-vpc"
    cidr_block = var.cidr_block
  }
}

resource "terraform_data" "subnet" {
  count = var.subnet_count
  input = cidrsubnet(var.cidr_block, 8, count.index)
}

output "network_name" {
  value = terraform_data.network.output.name
}

output "subnet_ranges" {
  value = terraform_data.subnet[*].output
}

module "dev" {
  source = "./modules/network"
  name   = "dev"
}

module "prod" {
  source     = "./modules/network"
  name       = "prod"
  cidr_block = "10.20.0.0/16"
}

output "dev_subnets" {
  value = module.dev.subnet_ranges
}

output "prod_subnets" {
  value = module.prod.subnet_ranges
}

2. Set it up

terraform init

You should see it find both module calls: - dev in modules/network and - prod in modules/network, then "successfully initialized".

3. Preview

terraform plan

Plan: 6 to add, 0 to change, 0 to destroy. A network and two subnets for each environment.

4. Build it, then look at the outputs

terraform apply
terraform output

Type yes when asked. Dev gets 10.0.0.0/24 and 10.0.1.0/24. Prod gets 10.20.0.0/24 and 10.20.1.0/24. That's cidrsubnet() at work.

5. Fix once, every environment benefits

In modules/network/variables.tf, change the subnet_count default from 2 to 3. Then:

terraform plan

Plan: 2 to add: one new subnet in dev and one in prod, from a single change. Run terraform apply to keep it.

6. The trap: rename a module call

In main.tf, rename module "dev" to module "development", and change module.dev.subnet_ranges to module.development.subnet_ranges. A renamed call counts as a new one, so set up again first:

terraform init
terraform plan

Plan: 4 to add, 0 to change, 4 to destroy. Terraform wants to destroy dev and rebuild it, just because the name changed. Don't apply this. (Skip the init and plan stops with "Module not installed".)

7. The fix: add a moved block to main.tf

moved {
  from = module.dev
  to   = module.development
}

terraform plan

Four lines ending "has moved to module.development…", then Plan: 0 to add, 0 to change, 0 to destroy. Same objects, new address. Run terraform apply.

Keep this folder. Episode 2's lab carries on from here.

Tested step by step with OpenTofu 1.12.6 on 30 September 2026. The lab uses only features built into both tools. With OpenTofu, type tofu instead of terraform, and messages say "OpenTofu" instead of "Terraform". It could not be run with the Terraform program itself in the test environment.