diff --git a/modules/ha-hot-hot/aws/outputs.tf b/modules/ha-hot-hot/aws/outputs.tf
index 1279f05..9c66d19 100644
--- a/modules/ha-hot-hot/aws/outputs.tf
+++ b/modules/ha-hot-hot/aws/outputs.tf
@@ -9,7 +9,8 @@ output "alb_zone_id" {
 }
 
 output "alb_arn" {
-  value = aws_lb.main.arn
+  description = "ARN of the Application Load Balancer. Use for attaching WAF web ACLs, Lambda triggers, or cross-account resource policies."
+  value       = aws_lb.main.arn
 }
 
 output "instance_ids" {
@@ -75,10 +76,12 @@ output "waf_attached" {
 }
 
 output "ami_id" {
-  value = data.aws_ami.hailbytes.id
+  description = "AMI ID resolved from the HailBytes Marketplace image for this product and version. Useful for audit logging and drift detection."
+  value       = data.aws_ami.hailbytes.id
 }
 
 output "security_group_ids" {
+  description = "Map of security group IDs keyed by role: alb, vm, db, redis. The redis key is null when Redis is not managed by this module."
   value = {
     alb   = aws_security_group.alb.id
     vm    = aws_security_group.vm.id
diff --git a/modules/ha-hot-hot/azure/outputs.tf b/modules/ha-hot-hot/azure/outputs.tf
index e12f9c8..85031b1 100644
--- a/modules/ha-hot-hot/azure/outputs.tf
+++ b/modules/ha-hot-hot/azure/outputs.tf
@@ -4,7 +4,8 @@ output "load_balancer_public_ip" {
 }
 
 output "load_balancer_id" {
-  value = azurerm_lb.main.id
+  description = "Resource ID of the internal Azure Load Balancer. Not the primary endpoint when enable_application_gateway = true — use application_gateway_id in that case."
+  value       = azurerm_lb.main.id
 }
 
 output "application_gateway_id" {
@@ -18,7 +19,8 @@ output "vm_ids" {
 }
 
 output "vm_private_ips" {
-  value = azurerm_network_interface.vm[*].private_ip_address
+  description = "Private IP addresses of the two active/active VMs, in the same order as vm_ids."
+  value       = azurerm_network_interface.vm[*].private_ip_address
 }
 
 output "postgres_fqdn" {
diff --git a/modules/network/aws/outputs.tf b/modules/network/aws/outputs.tf
index 73cdb7f..1dc27fc 100644
--- a/modules/network/aws/outputs.tf
+++ b/modules/network/aws/outputs.tf
@@ -4,7 +4,8 @@ output "vpc_id" {
 }
 
 output "vpc_cidr" {
-  value = aws_vpc.main.cidr_block
+  description = "CIDR block of the VPC. Useful for allowlisting in security group rules outside this module."
+  value       = aws_vpc.main.cidr_block
 }
 
 output "public_subnet_ids" {
@@ -23,7 +24,8 @@ output "db_subnet_ids" {
 }
 
 output "availability_zones" {
-  value = data.aws_availability_zones.available.names
+  description = "Availability zone names actually used (length = az_count). Reference these when sizing resources to match the network topology."
+  value       = data.aws_availability_zones.available.names
 }
 
 output "nat_gateway_ids" {
@@ -37,5 +39,6 @@ output "nat_gateway_public_ips" {
 }
 
 output "internet_gateway_id" {
-  value = aws_internet_gateway.main.id
+  description = "ID of the Internet Gateway attached to the VPC. Useful for dependency ordering in custom route table rules."
+  value       = aws_internet_gateway.main.id
 }
diff --git a/modules/network/aws/variables.tf b/modules/network/aws/variables.tf
index 4edc967..d5a314b 100644
--- a/modules/network/aws/variables.tf
+++ b/modules/network/aws/variables.tf
@@ -32,11 +32,13 @@ variable "enable_flow_logs" {
 }
 
 variable "flow_logs_retention_days" {
-  type    = number
-  default = 30
+  description = "Retention period in days for VPC Flow Logs in CloudWatch. Applies only when enable_flow_logs = true."
+  type        = number
+  default     = 30
 }
 
 variable "tags" {
-  type    = map(string)
-  default = {}
+  description = "Tags to apply to all network resources created by this module."
+  type        = map(string)
+  default     = {}
 }
diff --git a/modules/network/azure/outputs.tf b/modules/network/azure/outputs.tf
index 67e6dd6..c0d4a2d 100644
--- a/modules/network/azure/outputs.tf
+++ b/modules/network/azure/outputs.tf
@@ -1,9 +1,11 @@
 output "vnet_id" {
-  value = azurerm_virtual_network.main.id
+  description = "Resource ID of the virtual network. Pass to workload modules that need to peer or reference the VNet."
+  value       = azurerm_virtual_network.main.id
 }
 
 output "vnet_name" {
-  value = azurerm_virtual_network.main.name
+  description = "Name of the virtual network. Required when creating VNet peerings or referencing subnets via the Azure portal."
+  value       = azurerm_virtual_network.main.name
 }
 
 output "workload_subnet_id" {
@@ -27,5 +29,6 @@ output "private_dns_zone_id" {
 }
 
 output "private_dns_zone_name" {
-  value = azurerm_private_dns_zone.postgres.name
+  description = "Name of the private DNS zone for Postgres (e.g. '<prefix>.postgres.database.azure.com'). Pass to var.private_dns_zone_name on ha-hot-hot / unlimited-scale."
+  value       = azurerm_private_dns_zone.postgres.name
 }
diff --git a/modules/network/azure/variables.tf b/modules/network/azure/variables.tf
index 94e336a..c1118fa 100644
--- a/modules/network/azure/variables.tf
+++ b/modules/network/azure/variables.tf
@@ -44,6 +44,7 @@ variable "associate_subnet_nsgs" {
 }
 
 variable "tags" {
-  type    = map(string)
-  default = {}
+  description = "Tags to apply to all network resources created by this module."
+  type        = map(string)
+  default     = {}
 }