Terraform: read other workspaces' state with terraform_remote_state, carefully

TL;DR

It works, but it is the tightest coupling Terraform offers: you now depend on the other workspace's state layout, backend config, and apply order. There is no dependency ordering: if the network workspace has never been applied, the data source fails.

Steps

1. Splitting infra into network and app workspaces means the app needs the network's outputs (VPC id, subnet ids). terraform_remote_state reads them straight from the other workspace's state file. It works, but it is the tightest coupling Terraform offers: you now depend on the other workspace's state layout, backend config, and apply order.

data "terraform_remote_state" "network" {
 backend = "s3"
 config = {
 bucket = "myapp-terraform-state"
 key [your value]
 region = "us-east-1"
 }
}

locals {
 vpc_id = data.terraform_remote_state.network.outputs.vpc_id
}

2. The data source reads the ENTIRE remote state, including its secrets. Anyone who can plan the app workspace can read the network workspace's secrets. Prefer narrow outputs or an explicit parameter store for cross-workspace values.
3. There is no dependency ordering: if the network workspace has never been applied, the data source fails. Document the apply order; better, enforce it in CI.
4. Backend config is duplicated in the data source. When the backend moves, every terraform_remote_state block moves too. Keep a list.
5. Consider alternatives before reaching for it: a shared variables file, SSM Parameter Store / Secrets Manager lookups, or HCP Terraform run triggers with remote state sharing.
6. Never point terraform_remote_state at a state file you do not own. Reading another team's state is a coupling and a permissions smell.

When to use

You are seeing this: Splitting infra into network and app workspaces means the app needs the network's outputs (VPC id, subnet ids). terraform\remote\state reads them straight from the other workspace's state file. Use this skill when you run into "Terraform: read other workspaces' state with terraformremotestate, carefully".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Splitting infra into network and app workspaces means the app needs the network's outputs (VPC id, subnet ids). terraform\remote\state reads them straight from the other workspace's state file.

terraformremotestate data source reads outputs from another workspace's state via a backend config; it exposes the full remote state including sensitive values. Verified against live docs 2026-09-26. Verified against live docs 2026-09-26.