{"id":1229,"date":"2026-10-12T15:24:18","date_gmt":"2026-10-12T15:24:18","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1229"},"modified":"2026-10-12T15:24:19","modified_gmt":"2026-10-12T15:24:19","slug":"terraform-lab-azure-local-values-and-outputs","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/terraform-lab-azure-local-values-and-outputs\/","title":{"rendered":"Terraform Lab \u2013 Azure \u2013\u00a0 Local Values and Outputs"},"content":{"rendered":"\n

Continuation of Labs 1\u20134 and Part 2 (All Six Input Variable Types)<\/strong>
Level:<\/strong> Beginner \u2192 Early Intermediate
Terraform:<\/strong> 1.15.9+ within version 1.x
AzureRM provider:<\/strong> 5.9.x (same provider constraint as Part 2)
Date:<\/strong> 12 October 2026<\/p>\n\n\n\n

Lab objective<\/h2>\n\n\n\n

Extend the exact final Part 2 Terraform configuration<\/strong> by introducing only two new Terraform block types:<\/p>\n\n\n\n

    \n
  1. locals { ... }<\/code><\/strong>\u00a0\u2014 give names to internal, reusable expressions.<\/li>\n\n\n\n
  2. output \"...\" { ... }<\/code><\/strong>\u00a0\u2014 expose useful infrastructure information after an apply.<\/li>\n<\/ol>\n\n\n\n

    No new Azure infrastructure is introduced.<\/strong> The existing 12 input variables<\/strong> and 13 Terraform-managed Azure resources<\/strong> remain, and their Terraform resource addresses are unchanged. We do not introduce data sources, modules, count<\/code>, for_each<\/code>, provisioners, new providers, or any other resource blocks.<\/p>\n\n\n\n

    Lab progression<\/h3>\n\n\n\n
    Labs 1\u20134:  Resource Group -> Network -> Windows VM -> Ubuntu VM\nPart 2:     All six input variable types\nPart 3:     Local Values + Output Values   <-- THIS LESSON\n<\/code><\/pre>\n\n\n\n
    \n
    Critical:<\/strong> Work in the same working directory, same Azure subscription, and same Terraform state<\/strong> as Part 2. Replace the existing main.tf<\/code> with the full code below, but keep your working terraform.tfvars<\/code> values unchanged<\/strong>. Do not run terraform destroy<\/code> between these lessons.<\/p>\n<\/blockquote>\n\n\n\n
    1. What are Local Values?<\/h2>\n\n\n\n
    Local values are named expressions defined inside a locals<\/code> block. They help reduce repeated logic and make configuration easier to read. Unlike input variables<\/strong>, local values are not assigned through terraform.tfvars<\/code> or -var<\/code><\/strong>; Terraform calculates them from expressions in the configuration.<\/p>\n\n\n\n
    Syntax:<\/strong><\/p>\n\n\n\n
    locals {\n  my_location = var.azure_region\n  my_message  = \"Deploying to ${var.azure_region}\"\n}\n<\/code><\/pre>\n\n\n\n
    Reference syntax:<\/strong> local.my_location<\/code> \u2014 singular local<\/code><\/strong>, even though the declaration is locals<\/code>.<\/p>\n\n\n\n
    Input variables vs. local values vs. output values<\/h3>\n\n\n\n
    Concept<\/th>Block<\/th>Reference<\/th>Purpose<\/th>Set using terraform.tfvars<\/code>?<\/th><\/tr><\/thead>
    Input variable<\/td>variable \"name\"<\/code><\/td>var.name<\/code><\/td>Accept configurable inputs<\/td>Yes<\/td><\/tr>
    Local value<\/td>locals<\/code><\/td>local.name<\/code><\/td>Reuse or transform values inside configuration<\/td>No<\/td><\/tr>
    Output value<\/td>output \"name\"<\/code><\/td>terraform output name<\/code> (root module CLI)<\/td>Expose results such as assigned public IPs<\/td>No<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Our single new locals<\/code> block contains:<\/p>\n\n\n\n
    Local value<\/th>Derived from<\/th>Used by<\/th>Result with Part 2 values<\/th><\/tr><\/thead>
    local.resource_group_name<\/code><\/td>var.resource_names[\"resource_group\"]<\/code><\/td>Resource Group<\/td>rg-terraform-lab-eastus<\/code><\/td><\/tr>
    local.azure_location<\/code><\/td>var.azure_region<\/code><\/td>Resource Group<\/td>eastus<\/code><\/td><\/tr>
    local.vm_size<\/code><\/td>var.vm_size<\/code><\/td>Both VMs<\/td>Standard_B2s_v2<\/code><\/td><\/tr>
    local.vm_names<\/code><\/td>Two existing map entries<\/td>Both VMs and an output<\/td>Windows and Ubuntu VM names<\/td><\/tr>
    local.admin_source_cidrs<\/code><\/td>sort(tolist(var.admin_allowed_cidrs))<\/code><\/td>Both NSG rules and an output<\/td>Stable list of trusted CIDRs<\/td><\/tr>
    local.access_ports<\/code><\/td>The existing RDP\/SSH port numbers<\/td>NSG rules and RDP connection output<\/td>rdp = \"3389\"<\/code>, ssh = \"22\"<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    The key teaching example is local.admin_source_cidrs<\/code><\/strong>. In Part 2, both NSG rules independently repeated sort(tolist(var.admin_allowed_cidrs))<\/code>. In Part 3, the expression appears once<\/strong> in locals<\/code> and both rules refer to the same result. The effective Azure configuration is unchanged.<\/p>\n\n\n\n
    2. What are Output Values?<\/h2>\n\n\n\n
    Outputs expose information from resources and expressions<\/strong>, such as the actual public IP Azure assigned to a VM. Terraform displays new or changed root-module output values after terraform apply<\/code>. Later, students can retrieve them with terraform output<\/code> instead of searching the Azure Portal.<\/p>\n\n\n\n
    Example:<\/p>\n\n\n\n
    output \"windows_public_ip\" {\n  description = \"Public IPv4 address of the Windows Server VM.\"\n  value       = azurerm_public_ip.windows.ip_address\n}\n<\/code><\/pre>\n\n\n\n
    Output references are not data sources<\/strong>. This output reads an attribute of the azurerm_public_ip.windows<\/code> resource already created by Terraform<\/strong>.<\/p>\n\n\n\n
    Outputs included in this lab<\/h3>\n\n\n\n
    Output<\/th>Data type<\/th>Purpose<\/th><\/tr><\/thead>
    resource_group_name<\/code><\/td>String<\/td>Existing Resource Group name<\/td><\/tr>
    virtual_network_name<\/code><\/td>String<\/td>Existing VNet name<\/td><\/tr>
    subnet_name<\/code><\/td>String<\/td>Existing subnet name<\/td><\/tr>
    vm_names<\/code><\/td>Map\/object<\/td>Both VM names in one output<\/td><\/tr>
    windows_public_ip<\/code><\/td>String<\/td>Public IP assigned to Windows<\/td><\/tr>
    ubuntu_public_ip<\/code><\/td>String<\/td>Public IP assigned to Ubuntu<\/td><\/tr>
    windows_rdp_target<\/code><\/td>String<\/td>Windows IP and RDP port (IP:3389<\/code>)<\/td><\/tr>
    ubuntu_ssh_command<\/code><\/td>String<\/td>Ready-to-copy SSH command<\/td><\/tr>
    allowed_admin_cidrs<\/code><\/td>List of strings<\/td>CIDRs permitted by the inbound NSG rules<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    No passwords are output.<\/strong> Output values are saved in Terraform state. Avoid exporting passwords, tokens, private keys, or other secrets. Even sensitive = true<\/code> outputs can be revealed via certain Terraform CLI flags or the state file.<\/p>\n\n\n\n
    3. File layout<\/h2>\n\n\n\n
    azure-terraform-labs\/\n\u251c\u2500\u2500 main.tf             # Full Part 3: provider + variables + locals + 13 resources + outputs\n\u251c\u2500\u2500 terraform.tfvars    # UNCHANGED input values from Part 2\n\u251c\u2500\u2500 terraform.tfstate   # Existing state (when using local state)\n\u2514\u2500\u2500 .terraform.lock.hcl # Existing provider dependency lock\n<\/code><\/pre>\n\n\n\n
    Use only the two authored files<\/strong>, main.tf<\/code> and terraform.tfvars<\/code>, for this lesson. Do not add other .tf<\/code> files or redeclare resource blocks.<\/p>\n\n\n\n
    4. Complete main.tf<\/code> \u2014 copy everything<\/h2>\n\n\n\n
    The following is a complete replacement file<\/strong>, not a fragment. It retains every Part 2 variable and resource and adds the locals<\/code> and output<\/code> blocks.<\/p>\n\n\n\n
    # ============================================\n# PART 3 - INPUT VARIABLES + LOCAL VALUES + OUTPUTS\n# Keeps the same 13 resources and images from Labs 1-4\n# ============================================\n\nterraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\n# ============================================================\n# INPUT VARIABLES FROM PART 2 (ALL SIX TYPES)\n# ============================================================\n\n# STRING - Azure region and VM settings\nvariable \"azure_region\" {\n  description = \"Azure region for every resource in this lab.\"\n  type        = string\n}\n\nvariable \"vm_size\" {\n  description = \"Size used by both virtual machines.\"\n  type        = string\n}\n\nvariable \"admin_username\" {\n  description = \"Local administrator username on both VMs.\"\n  type        = string\n}\n\nvariable \"windows_admin_password\" {\n  description = \"Administrator password for the Windows Server VM.\"\n  type        = string\n  sensitive   = true\n}\n\nvariable \"ubuntu_admin_password\" {\n  description = \"Administrator password for the Ubuntu VM.\"\n  type        = string\n  sensitive   = true\n}\n\n# NUMBER - NSG rule priorities\nvariable \"rdp_priority\" {\n  description = \"Inbound RDP rule priority, between 100 and 4096.\"\n  type        = number\n}\n\nvariable \"ssh_priority\" {\n  description = \"Inbound SSH rule priority, between 100 and 4096.\"\n  type        = number\n}\n\n# BOOL - keep Linux password authentication enabled for this lab\nvariable \"disable_linux_password_authentication\" {\n  description = \"Must be false while ubuntu_admin_password is configured.\"\n  type        = bool\n}\n\n# LIST(STRING) - ordered Azure network address prefixes\nvariable \"vnet_address_spaces\" {\n  description = \"Address spaces configured on the Azure virtual network.\"\n  type        = list(string)\n}\n\nvariable \"subnet_address_prefixes\" {\n  description = \"Address prefixes configured on the VM subnet.\"\n  type        = list(string)\n}\n\n# SET(STRING) - unique source CIDRs permitted to use SSH\/RDP\nvariable \"admin_allowed_cidrs\" {\n  description = \"Unique public IPv4 CIDRs allowed to reach SSH and RDP.\"\n  type        = set(string)\n}\n\n# MAP(STRING) - stable names of the existing Azure resources\nvariable \"resource_names\" {\n  description = \"Resource names from Labs 1-4. Keep unchanged to retain state.\"\n  type        = map(string)\n}\n\n# ============================================================\n# PART 3 - LOCAL VALUES (DERIVED FROM PART 2 INPUT VARIABLES)\n# ============================================================\nlocals {\n  # Name and region from the existing input variables.\n  resource_group_name = var.resource_names[\"resource_group\"]\n  azure_location      = var.azure_region\n  vm_size             = var.vm_size\n\n  # Reusable map of the names of the two existing VMs.\n  vm_names = {\n    windows = var.resource_names[\"windows_vm\"]\n    ubuntu  = var.resource_names[\"ubuntu_vm\"]\n  }\n\n  # Turn the input set into a consistently ordered list for both NSG rules.\n  admin_source_cidrs = sort(tolist(var.admin_allowed_cidrs))\n\n  # Reuse the same port definitions in security rules and outputs.\n  access_ports = {\n    rdp = \"3389\"\n    ssh = \"22\"\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n\n# --------------------------------------------\n# 1. Resource Group\n# --------------------------------------------\nresource \"azurerm_resource_group\" \"lab\" {\n  name     = local.resource_group_name\n  location = local.azure_location\n}\n\n# --------------------------------------------\n# 2. Virtual Network\n# --------------------------------------------\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = var.resource_names[\"virtual_network\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  address_space = var.vnet_address_spaces\n}\n\n# --------------------------------------------\n# 3. Subnet\n# --------------------------------------------\nresource \"azurerm_subnet\" \"vms\" {\n  name                 = var.resource_names[\"subnet\"]\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n\n  address_prefixes = var.subnet_address_prefixes\n}\n\n# --------------------------------------------\n# 4. Network Security Group\n# --------------------------------------------\nresource \"azurerm_network_security_group\" \"lab\" {\n  name                = var.resource_names[\"nsg\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\n# --------------------------------------------\n# 5. Associate NSG with Subnet\n# --------------------------------------------\nresource \"azurerm_subnet_network_security_group_association\" \"lab\" {\n  subnet_id                 = azurerm_subnet.vms.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\n# --------------------------------------------\n# 6. Allow RDP from approved public IPv4 CIDRs\n# --------------------------------------------\nresource \"azurerm_network_security_rule\" \"rdp\" {\n  name                        = var.resource_names[\"rdp_rule\"]\n  priority                    = var.rdp_priority\n  direction                   = \"Inbound\"\n  access                      = \"Allow\"\n  protocol                    = \"Tcp\"\n  source_port_range           = \"*\"\n  destination_port_range      = local.access_ports.rdp\n  source_address_prefixes     = local.admin_source_cidrs\n  destination_address_prefix  = \"*\"\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\n# --------------------------------------------\n# 7. Allow SSH from approved public IPv4 CIDRs\n# --------------------------------------------\nresource \"azurerm_network_security_rule\" \"ssh\" {\n  name                        = var.resource_names[\"ssh_rule\"]\n  priority                    = var.ssh_priority\n  direction                   = \"Inbound\"\n  access                      = \"Allow\"\n  protocol                    = \"Tcp\"\n  source_port_range           = \"*\"\n  destination_port_range      = local.access_ports.ssh\n  source_address_prefixes     = local.admin_source_cidrs\n  destination_address_prefix  = \"*\"\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\n# --------------------------------------------\n# 8. Windows VM Public IP\n# --------------------------------------------\nresource \"azurerm_public_ip\" \"windows\" {\n  name                = var.resource_names[\"windows_public_ip\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  allocation_method = \"Static\"\n  sku               = \"Standard\"\n}\n\n# --------------------------------------------\n# 9. Windows VM Network Interface\n# --------------------------------------------\nresource \"azurerm_network_interface\" \"windows\" {\n  name                = var.resource_names[\"windows_nic\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.vms.id\n    private_ip_address_allocation = \"Dynamic\"\n    public_ip_address_id          = azurerm_public_ip.windows.id\n  }\n}\n\n# --------------------------------------------\n# 10. Windows Server 2025 VM\n# --------------------------------------------\nresource \"azurerm_windows_virtual_machine\" \"windows\" {\n  name                = local.vm_names.windows\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  size           = local.vm_size\n  admin_username = var.admin_username\n\n  # Keep the same Windows password used when the VM was created\n  admin_password = var.windows_admin_password\n\n  network_interface_ids = [\n    azurerm_network_interface.windows.id\n  ]\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"MicrosoftWindowsServer\"\n    offer     = \"WindowsServer\"\n    sku       = \"2025-datacenter\"\n    version   = \"latest\"\n  }\n}\n\n# --------------------------------------------\n# 11. Ubuntu VM Public IP\n# --------------------------------------------\nresource \"azurerm_public_ip\" \"ubuntu\" {\n  name                = var.resource_names[\"ubuntu_public_ip\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  allocation_method = \"Static\"\n  sku               = \"Standard\"\n}\n\n# --------------------------------------------\n# 12. Ubuntu VM Network Interface\n# --------------------------------------------\nresource \"azurerm_network_interface\" \"ubuntu\" {\n  name                = var.resource_names[\"ubuntu_nic\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.vms.id\n    private_ip_address_allocation = \"Dynamic\"\n    public_ip_address_id          = azurerm_public_ip.ubuntu.id\n  }\n}\n\n# --------------------------------------------\n# 13. Ubuntu Server 26.04 LTS VM\n# --------------------------------------------\nresource \"azurerm_linux_virtual_machine\" \"ubuntu\" {\n  name                = local.vm_names.ubuntu\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  size           = local.vm_size\n  admin_username = var.admin_username\n\n  # Training only - supplied through terraform.tfvars; keep secret\n  admin_password = var.ubuntu_admin_password\n\n  # Enable SSH password authentication\n  disable_password_authentication = var.disable_linux_password_authentication\n\n  network_interface_ids = [\n    azurerm_network_interface.ubuntu.id\n  ]\n\n  # OS Disk\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  # Ubuntu Server 26.04 LTS Gen2 Image\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n\n# ============================================================\n# PART 3 - OUTPUT VALUES (NO NEW AZURE RESOURCES)\n# ============================================================\n\n# Single string output: Resource Group name\noutput \"resource_group_name\" {\n  description = \"Name of the existing Azure resource group.\"\n  value       = azurerm_resource_group.lab.name\n}\n\n# Single string output: VNet name\noutput \"virtual_network_name\" {\n  description = \"Name of the lab virtual network.\"\n  value       = azurerm_virtual_network.lab.name\n}\n\n# Single string output: Subnet name\noutput \"subnet_name\" {\n  description = \"Name of the VM subnet.\"\n  value       = azurerm_subnet.vms.name\n}\n\n# Map\/object output: both VM names\noutput \"vm_names\" {\n  description = \"Windows and Ubuntu VM names, grouped by operating system.\"\n  value       = local.vm_names\n}\n\n# Computed Azure IP addresses (available once resources exist)\noutput \"windows_public_ip\" {\n  description = \"Public IPv4 address of the Windows Server VM.\"\n  value       = azurerm_public_ip.windows.ip_address\n}\n\noutput \"ubuntu_public_ip\" {\n  description = \"Public IPv4 address of the Ubuntu Server VM.\"\n  value       = azurerm_public_ip.ubuntu.ip_address\n}\n\n# Computed text outputs: connection hints (no passwords)\noutput \"windows_rdp_target\" {\n  description = \"RDP target for Windows Remote Desktop.\"\n  value       = \"${azurerm_public_ip.windows.ip_address}:${local.access_ports.rdp}\"\n}\n\noutput \"ubuntu_ssh_command\" {\n  description = \"SSH command to access Ubuntu from an authorized IP address.\"\n  value       = \"ssh ${var.admin_username}@${azurerm_public_ip.ubuntu.ip_address}\"\n}\n\n# List output: stable, sorted CIDRs used by both NSG rules\noutput \"allowed_admin_cidrs\" {\n  description = \"Sorted source CIDRs authorized for SSH and RDP by the lab NSG.\"\n  value       = local.admin_source_cidrs\n}\n\n<\/code><\/pre>\n\n\n\n
    5. Complete terraform.tfvars<\/code> \u2014 keep the same values as Part 2<\/h2>\n\n\n\n
    If your Part 2 lab is already deployed, leave the actual values unchanged.<\/strong> In particular, preserve the two existing VM passwords. Replacing them with the illustrative passwords below when your real deployment uses different passwords can cause a VM replacement.<\/p>\n\n\n\n
    The placeholder 203.0.113.10\/32<\/code> is not a usable remote-access address<\/strong>. If you already replaced it with your current public IPv4 \/32<\/code> in Part 2, keep that working address.<\/p>\n\n\n\n
    # ============================================================\n# PART 2 - TERRAFORM VARIABLE VALUES\n# Save as terraform.tfvars in the SAME directory as main.tf.\n# IMPORTANT: Preserve the actual values used in Labs 1-4.\n# ============================================================\n\n# STRING\nazure_region  = \"eastus\"\nvm_size       = \"Standard_B2s_v2\"\nadmin_username = \"labadmin\"\n\n# Replace these EXAMPLE passwords with the ones used in Lab 3 and Lab 4.\n# If the VMs already exist, changing the passwords can replace the VMs.\nwindows_admin_password = \"ChangeMe!2026WinLab#\"\nubuntu_admin_password  = \"ChangeMe!2026LinuxLab#\"\n\n# NUMBER: unique NSG priorities (100-4096)\nrdp_priority = 100\nssh_priority = 110\n\n# BOOL: must remain false for Ubuntu password-based login\ndisable_linux_password_authentication = false\n\n# LIST(STRING): ordered collections\nvnet_address_spaces      = [\"10.20.0.0\/16\"]\nsubnet_address_prefixes  = [\"10.20.1.0\/24\"]\n\n# SET(STRING): Terraform converts this list-like literal to a set.\n# REPLACE 203.0.113.10\/32 with YOUR public IPv4 address\/32.\n# The example address is reserved for documentation, not your real IP.\nadmin_allowed_cidrs = [\"203.0.113.10\/32\"]\n\n# MAP(STRING): resource names must match the previous labs exactly.\nresource_names = {\n  resource_group    = \"rg-terraform-lab-eastus\"\n  virtual_network   = \"vnet-terraform-lab\"\n  subnet            = \"snet-vms\"\n  nsg               = \"nsg-terraform-lab\"\n  rdp_rule          = \"Allow-RDP\"\n  ssh_rule          = \"Allow-SSH\"\n  windows_public_ip = \"pip-win2025-lab\"\n  windows_nic       = \"nic-win2025-lab\"\n  windows_vm        = \"vm-win2025-01\"\n  ubuntu_public_ip  = \"pip-ubuntu2604-lab\"\n  ubuntu_nic        = \"nic-ubuntu2604-lab\"\n  ubuntu_vm         = \"vm-ubuntu2604-01\"\n}\n\n<\/code><\/pre>\n\n\n\n
    6. What exactly changed compared with Part 2?<\/h2>\n\n\n\n
    6.1 The new locals<\/code> block<\/h3>\n\n\n\n
    locals {\n  resource_group_name = var.resource_names[\"resource_group\"]\n  azure_location      = var.azure_region\n  vm_size             = var.vm_size\n\n  vm_names = {\n    windows = var.resource_names[\"windows_vm\"]\n    ubuntu  = var.resource_names[\"ubuntu_vm\"]\n  }\n\n  admin_source_cidrs = sort(tolist(var.admin_allowed_cidrs))\n\n  access_ports = {\n    rdp = \"3389\"\n    ssh = \"22\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
    Terraform evaluates these expressions; there is no separate Azure object called a local value<\/em>.<\/p>\n\n\n\n
    6.2 Changes to existing resources \u2014 values remain the same<\/h3>\n\n\n\n
    In Part 2<\/th>In Part 3<\/th>Why<\/th><\/tr><\/thead>
    name = var.resource_names[\"resource_group\"]<\/code><\/td>name = local.resource_group_name<\/code><\/td>Readability<\/td><\/tr>
    location = var.azure_region<\/code><\/td>location = local.azure_location<\/code><\/td>Demonstrate local references<\/td><\/tr>
    size = var.vm_size<\/code><\/td>size = local.vm_size<\/code><\/td>Reuse VM size in both VMs<\/td><\/tr>
    name = var.resource_names[\"windows_vm\"]<\/code><\/td>name = local.vm_names.windows<\/code><\/td>Use a local map<\/td><\/tr>
    name = var.resource_names[\"ubuntu_vm\"]<\/code><\/td>name = local.vm_names.ubuntu<\/code><\/td>Use a local map<\/td><\/tr>
    source_address_prefixes = sort(tolist(var.admin_allowed_cidrs))<\/code><\/td>source_address_prefixes = local.admin_source_cidrs<\/code><\/td>Avoid duplicate conversion\/sorting<\/td><\/tr>
    destination_port_range = \"3389\"<\/code><\/td>destination_port_range = local.access_ports.rdp<\/code><\/td>Name RDP port<\/td><\/tr>
    destination_port_range = \"22\"<\/code><\/td>destination_port_range = local.access_ports.ssh<\/code><\/td>Name SSH port<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Important:<\/strong> local<\/code> expressions produce the same values<\/strong> as the original Part 2 code; they don’t automatically create, destroy, or rename resources. These expression-only changes should not require changing your Azure resources, provided your prior state and .tfvars<\/code> still match. Unexpected Azure resource changes must be investigated before applying.<\/p>\n\n\n\n
    6.3 Nine new outputs<\/h3>\n\n\n\n
    Outputs reference the existing resources and computed locals. The most useful ones are:<\/p>\n\n\n\n
    output \"windows_public_ip\" {\n  description = \"Public IPv4 address of the Windows Server VM.\"\n  value       = azurerm_public_ip.windows.ip_address\n}\n\noutput \"ubuntu_ssh_command\" {\n  description = \"SSH command to access Ubuntu from an authorized IP address.\"\n  value       = \"ssh ${var.admin_username}@${azurerm_public_ip.ubuntu.ip_address}\"\n}\n<\/code><\/pre>\n\n\n\n
    The username and IP are exposed, not<\/strong> the administrator password. RDP and SSH connections also depend on your real public IP being permitted by the NSG, the guest OS being ready, and any organizational network restrictions.<\/p>\n\n\n\n
    7. Execute Part 3 safely<\/h2>\n\n\n\n
    Step 1 \u2014 Verify correct directory, identity, and existing state<\/h3>\n\n\n\n
    # Run inside the SAME Part 2 directory.<\/em>\naz login\naz account set --subscription \"YOUR_SUBSCRIPTION_ID\"\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\n\nterraform version\nterraform state list\n<\/code><\/pre>\n\n\n\n
    With an applied Part 2, terraform state list<\/code> should show the same 13 Terraform resource addresses<\/strong>.<\/p>\n\n\n\n
    Step 2 \u2014 Back up your existing code and state securely<\/h3>\n\n\n\n
    # Save a private copy of the existing main.tf before replacing it.<\/em>\ncp main.tf main.part2.backup.txt\n\n# If and only if you are using local Terraform state:<\/em>\ncp terraform.tfstate terraform.tfstate.part2.backup\n<\/code><\/pre>\n\n\n\n
    Note:<\/strong> The backups may contain or reference secrets; keep them outside public version control. Do not save the backup as another .tf<\/code> file, because Terraform loads every .tf<\/code> file in the directory, and duplicate blocks would break validation. Remote state users should follow their backend’s snapshot\/backup procedure instead.<\/p>\n\n\n\n
    Step 3 \u2014 Replace files<\/h3>\n\n\n\n
      \n
    1. Replace\u00a0main.tf<\/code>\u00a0with the\u00a0complete Part 3<\/strong>\u00a0file in Section 4.<\/li>\n\n\n\n
    2. Keep your existing Part 2\u00a0terraform.tfvars<\/code>\u00a0(Section 5 is a full reference copy).<\/li>\n\n\n\n
    3. Don’t modify the 13 resource addresses, existing images, VM passwords, resource names, network settings, or state.<\/li>\n<\/ol>\n\n\n\n
      Step 4 \u2014 Format, validate, and inspect the plan<\/h3>\n\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan -out=lab-part3.tfplan\nterraform show lab-part3.tfplan\n<\/code><\/pre>\n\n\n\n
      Expected for a previously applied, unchanged Part 2 environment:<\/strong> no Azure resource additions, updates, deletions, or replacements. Terraform should show output-value additions. The real plan is authoritative: if it proposes a VM replacement, resource deletion, or unexpected network change, do not apply<\/strong> until the difference is understood.<\/p>\n\n\n\n
      Step 5 \u2014 Apply the reviewed plan<\/h3>\n\n\n\n
      terraform apply lab-part3.tfplan\nterraform state list\n<\/code><\/pre>\n\n\n\n
      Adding outputs changes Terraform’s recorded output values, even if Azure resources themselves require no updates.<\/p>\n\n\n\n
      8. Practice the terraform output<\/code> command<\/h2>\n\n\n\n
      # Display every root-module output.<\/em>\nterraform output\n\n# Query a specific output.<\/em>\nterraform output windows_public_ip\n\n# Get a raw string without quotes; helpful for terminal scripts.<\/em>\nterraform output -raw ubuntu_public_ip\n\n# Display a single complex value such as vm_names as JSON.<\/em>\nterraform output -json vm_names\n\n# Display all outputs in JSON (does not mask sensitive outputs).<\/em>\nterraform output -json\n\n# Get your connection hint directly.<\/em>\nterraform output -raw ubuntu_ssh_command\n<\/code><\/pre>\n\n\n\n
      A hypothetical<\/strong> result after terraform apply<\/code> (the IPs below are illustrative; your actual IPs will differ):<\/p>\n\n\n\n
      allowed_admin_cidrs = tolist([\n  \"YOUR.PUBLIC.IP.ADDRESS\/32\",\n])\nresource_group_name = \"rg-terraform-lab-eastus\"\nsubnet_name = \"snet-vms\"\nubuntu_public_ip = \"ACTUAL_UBUNTU_PUBLIC_IP\"\nubuntu_ssh_command = \"ssh labadmin@ACTUAL_UBUNTU_PUBLIC_IP\"\nvirtual_network_name = \"vnet-terraform-lab\"\nvm_names = {\n  \"ubuntu\" = \"vm-ubuntu2604-01\"\n  \"windows\" = \"vm-win2025-01\"\n}\nwindows_public_ip = \"ACTUAL_WINDOWS_PUBLIC_IP\"\nwindows_rdp_target = \"ACTUAL_WINDOWS_PUBLIC_IP:3389\"\n<\/code><\/pre>\n\n\n\n
      Use your actual output values; don’t attempt to connect to the illustrative text above.<\/p>\n\n\n\n
      Optional: inspect the locals in Terraform Console<\/h3>\n\n\n\n
      terraform console\n<\/code><\/pre>\n\n\n\n
      Then enter one expression per line:<\/p>\n\n\n\n
      local.vm_names\nlocal.admin_source_cidrs\nlocal.access_ports.rdp\nlocal.vm_size\n<\/code><\/pre>\n\n\n\n
      Type exit<\/code> to return to your shell. This is only a read\/evaluation exercise; it doesn’t add an Azure resource.<\/p>\n\n\n\n
      9. Student exercises<\/h2>\n\n\n\n
        \n
      1. Identify:<\/strong>\u00a0Which expressions begin with\u00a0var.<\/code>\u00a0and which begin with\u00a0local.<\/code>\u00a0in\u00a0main.tf<\/code>?<\/li>\n\n\n\n
      2. Inspect:<\/strong>\u00a0Run\u00a0terraform output -raw windows_public_ip<\/code>\u00a0and locate the same IP in the Azure Portal.<\/li>\n\n\n\n
      3. Compare:<\/strong>\u00a0Run\u00a0terraform output -json vm_names<\/code>\u00a0and explain why\u00a0-raw vm_names<\/code>\u00a0is not suitable for a map\/object.<\/li>\n\n\n\n
      4. Understand reuse:<\/strong>\u00a0Find both NSG security rules that reference\u00a0local.admin_source_cidrs<\/code>.<\/li>\n\n\n\n
      5. Safety check:<\/strong>\u00a0Explain why\u00a0windows_admin_password<\/code>\u00a0should not be exported as a plain output value.<\/li>\n\n\n\n
      6. Review drift:<\/strong>\u00a0After using locals, explain why an existing Azure VM should not need replacement when its configured values stay unchanged.<\/li>\n<\/ol>\n\n\n\n
        10. Success checklist<\/h2>\n\n\n\n