Terraform pattern for multi-region multi-account deployments

base.auto.tfvars

role_arn = {
    development = "arn:aws:iam::123456789012:role/TFRole"
    production  = "arn:aws:iam::123456789013:role/TFRole"
}

main.tf

variable "role_arn" {
  description = "Map of role_arn to use in each account"
}

data "aws_vpc" "eu" {
  provider = aws.euw1
  filter {
    name   = "tag:Name"
    values = ["MyVPC"]
  }
}

data "aws_vpc" "us" {
  provider = aws.usw1
  filter {
    name   = "tag:Name"
    values = ["MyVPC"]
  }
}

output "eu" {
    value = data.aws_vpc.eu.arn
}

output "us" {
    value = data.aws_vpc.us.arn
}

providers.tf

provider "aws" {
    region = "eu-west-1"
}

provider "aws" {
    region = "eu-west-1"
    alias = "euw1"
    assume_role {
        role_arn = var.role_arn[terraform.workspace]
    }
}

provider "aws" {
    region = "us-west-1"
    alias = "usw1"
    assume_role {
        role_arn = var.role_arn[terraform.workspace]
    }
}

shell.sh

export WORKSPACE=development

terraform select workspace $WORKSPACE  || terraform new workspace $WORKSPACE

# This commands loads an additional variable file named development.tfvars
# Any environment specific customization can be put into this file
terraform plan -input=false -var-file $WORKSPACE.tfvars

terraform apply -input=false -auto-approve -var-file $WORKSPACE.tfvars