Visualize Terraform variable and resource dependencies across your IaC projects as an interactive directed acyclic graph (DAG). The Variable Graph shows how outputs from one project feed into variables of another, helping you understand blast radius and dependency chains.
The graph renders each IaC project as a folder node with three key metrics:
| Metric | Icon | Color | Description |
|---|---|---|---|
| Outputs | Upload | Green | Values this project exports for other projects to consume |
| Inputs | Download | Blue | Variables this project consumes from other projects |
| Resources | Box | Orange | Terraform resources defined in this project |
Edges between nodes represent dependency relationships.
| Type | Description |
|---|---|
| Remote State | Project reads outputs from another project's state via terraform_remote_state |
| Module | Project consumes a module defined in another project |
| Data Source | Project references a data source that reads from another project's resources |
See all projects and their dependencies across the entire organization:
Go to IaC → Variable Graph from the sidebar.
All projects appear as nodes with dependency edges between them.
View a single project and its direct dependencies:
Navigate to any IaC project.
Opens the graph filtered to this project and its connected projects.
The current project is highlighted with a purple "Current" badge. Connected projects show upstream (providers) and downstream (consumers).
Click any folder node to open the detail modal:
| Field | Description |
|---|---|
| Project Name | The IaC project name |
| Path | File path within the project |
| Variables | List of input variables with types and descriptions |
| Outputs | List of exported outputs |
| Resources | Count and types of Terraform resources |
| Impact Level | Low, Medium, or High based on downstream dependency count |
| Level | Criteria | Meaning |
|---|---|---|
| Low | 0–1 downstream dependents | Changes affect few projects |
| Medium | 2–4 downstream dependents | Changes may cascade to several projects |
| High | 5+ downstream dependents | Changes have wide blast radius — review carefully |
ops0 can scan all IaC projects to discover cross-project dependencies:
On the Variable Graph page, click Scan Projects.
ops0 analyzes all projects for terraform_remote_state blocks, module references, and data source dependencies.
The graph refreshes with all discovered dependencies.
Scanning is useful when:
| Use Case | How the Graph Helps |
|---|---|
| Blast radius analysis | Before modifying a project, see which downstream projects depend on its outputs |
| Debugging state issues | Trace which project provides a failing remote state reference |
| Onboarding | New team members can visualize how infrastructure projects connect |
| Refactoring | Identify tightly coupled projects that should be consolidated or decoupled |
| Change planning | Understand the order of operations when updating shared infrastructure |
The graph only shows projects that share compatible backends — projects must use the same state backend provider and cloud integration to reference each other's state.
| Backend | Cross-Reference Support |
|---|---|
| S3 | Projects sharing the same S3 bucket/region can reference each other |
| GCS | Projects in the same GCS bucket can reference each other |
| Azure Blob | Projects in the same storage account can reference each other |
Output references are the mechanism that actually links two IaC projects in the graph. When project B needs to consume a value from project A (e.g. a VPC ID), you create an output reference that wires A's output into B as a variable.
Open the IaC project that needs to read a value from another project.
In the editor toolbar, click Insert Output Reference (or use the output reference button in the file panel).
A picker shows all compatible projects — those that share the same state backend provider and cloud integration.
Choose which output from the source project to reference.
The following is inserted into your main.tf:
data "terraform_remote_state" "networking" {
backend = "s3"
config = {
bucket = "my-terraform-state"
key = "projects/networking/terraform.tfstate"
region = "us-east-1"
}
}
You can then use the value:
resource "aws_instance" "app" {
subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_id
}
Navigate to Project → Output References to see all output references configured for the project:
| Field | Description |
|---|---|
| Source project | The project providing the output |
| Output name | The specific output being consumed |
| Variable name | How the value is referenced in this project |
| Backend | State backend being read from |
To remove a reference, click Delete on the reference row, then remove the corresponding terraform_remote_state block from your code.
Output references only work between projects that share a compatible state backend:
| Backend | Projects must share |
|---|---|
| S3 | Same bucket and region |
| GCS | Same bucket |
| Azure Blob | Same storage account and container |
Projects with incompatible backends will not appear in the output reference picker.