Terraform无法读取环境变量：未声明输入变量问题求助

执行terraform plan时触发以下错误：

Error: Reference to undeclared input variable

on main.tf line 2, in provider "aws":
2: access_key = var.aws_access_key_id

An input variable with the name "aws_access_key_id" has not been declared. This variable can be declared with a variable "aws_access_key_id" {} block.
╵
╷
Error: Reference to undeclared input variable

on main.tf line 3, in provider "aws":
3: secret_key = var.aws_secret_access_key

An input variable with the name "aws_secret_access_key" has not been declared. This variable can be declared with a variable "aws_secret_access_key" {} block.
╵

当前main.tf内容：

provider "aws" {
  access_key = var.aws_access_key_id
  secret_key = var.aws_secret_access_key
  region     = "us-east-1"
}
    
resource "aws_instance" "my_rhel9_vm" {
  ami           = var.ami //RHEL 9 AMI
  instance_type = var.type
  count         = var.number_of_instances
  key_name      = var.amu.key_pair_name
    
  tags = {
    Name = "${var.name_tag}"
  }
}

已在同一shell中执行环境变量导出：

export TF_VAR_aws_access_key_id="xx"
export TF_VAR_aws_secret_access_key="yy"

解决方法 #

Terraform要求所有在配置中引用的var.xxx变量必须先声明，哪怕是通过环境变量传入也不例外。

1. 添加变量声明块
   创建一个variables.tf文件（或直接将代码追加到main.tf末尾），声明所需变量：

   variable "aws_access_key_id" {
     type        = string
     description = "AWS访问密钥ID"
   }
   
   variable "aws_secret_access_key" {
     type        = string
     description = "AWS秘密访问密钥"
     sensitive   = true # 标记为敏感变量，避免在输出/日志中泄露
   }
   
   # 别忘了声明main.tf中用到的其他变量，否则后续仍会报错
   variable "ami" {
     type        = string
     description = "RHEL 9实例使用的AMI ID"
   }
   
   variable "type" {
     type        = string
     description = "EC2实例类型"
     default     = "t2.micro" # 可选：设置默认值
   }
   
   variable "number_of_instances" {
     type        = number
     description = "要创建的EC2实例数量"
     default     = 1
   }
   
   variable "amu" {
     type = object({
       key_pair_name = string
     })
     description = "密钥对相关配置"
   }
   
   variable "name_tag" {
     type        = string
     description = "EC2实例的Name标签值"
   }
   

2. 验证配置
   保存文件后重新执行terraform plan，Terraform会自动读取你设置的TF_VAR_前缀环境变量，赋值给对应的var.aws_access_key_id和var.aws_secret_access_key。

额外提示 #

AWS Provider更推荐使用安全等级更高的身份验证方式：

• 本地AWS CLI配置文件（~/.aws/credentials）
• EC2实例角色（如果在AWS EC2实例上运行Terraform）
• AWS Secrets Manager等密钥管理服务

这些方式无需在代码中硬编码或通过环境变量传递密钥，更符合安全最佳实践。

内容的提问来源于stack exchange，提问作者Dan