A root module calls a child module named network, which creates private subnets. The root needs those subnet IDs for a database resource, but referencing module.network.aws_subnet.private[*].id fails with an error. Which change provides the IDs correctly?
Select an answer to reveal the explanation.
![To Create an exciting colorful infographic that explains the concepts in the question: Question: A root module calls a child module named network, which creates private subnets. The root needs those subnet IDs for a database resource, but referencing module.network.awssubnet.private[].id fails with an error. Which change provides the IDs correctly? Correct Answer: Declare an output named privatesubnetids in the child module and reference it from the root as module.network.privatesubnetids Put EVERY visible label in double quotes. No people. No A/B/C/D letters. In one of the four corners put a little "Navy Duck".](/media/hashicorp/terraform-pro-002/TERRAFORM-PRO-002-e1-q122.webp)
Short Explanation
A module is a sealed box with labelled ports. The only things the caller can see are the outputs you deliberately put on the outside. Reaching inside for a resource is like trying to grab a part through the casing; you have to give it a port first.
Full Explanation
Modules encapsulate their resources. A calling module cannot reference resources inside a child module by their internal addresses; the only values exposed to the caller are the child's output values. Declaring output "private_subnet_ids" in the child with a value such as the list of subnet IDs, and referencing module.network.private_subnet_ids in the root, passes the data across that boundary and also creates the dependency Terraform needs to order the database after the subnets. Adding depends_on does not make internal resource addresses visible; it only orders operations. Input variables carry data into a module from its caller, never out of a child, and Terraform does not populate variables from resources with matching names. terraform_remote_state reads root module outputs from a separate state snapshot; the child module shares the root's state and is not a separate configuration with its own state, so this is the wrong tool and still could not expose non-output values. Exam caveat: outputs are part of a module's public contract, so renaming or removing one is a breaking change for callers. Operational check: run terraform console and evaluate module.network.private_subnet_ids after a plan to confirm the expected list is returned.