Terraform · Cheat sheet

Terraform cheat sheet

The complete Terraform reference, beginner to advanced: the core workflow, formatting and validation, state surgery, workspaces, variables, modules, targeting, import/moved, and debugging — with example output.

Setup & initBeginner

terraform version

CLI and provider versions.

Terraform v1.9.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.62.0

terraform init

Download providers/modules and configure the backend.

Initializing the backend...
Initializing provider plugins...
- Installing hashicorp/aws v5.62.0...
Terraform has been successfully initialized!

terraform init -upgrade

Re-fetch providers to the newest allowed versions.

terraform init -reconfigure

Reconfigure the backend, ignoring saved settings.

terraform init -backend-config=prod.hcl

Load backend settings from a partial-config file.

terraform get -update

Download/update modules only (no provider work).

terraform login

Obtain and store an HCP Terraform / Cloud token.

Core workflowBeginner

terraform plan

Preview the changes needed to reach desired state.

Plan: 3 to add, 1 to change, 0 to destroy.

terraform plan -out=tfplan

Preview and save the exact plan to a file.

terraform apply

Show a plan, then apply after you type yes.

terraform apply tfplan

Apply a saved plan with no prompt and no surprises.

terraform apply -auto-approve

Skip the confirmation prompt (CI).

terraform destroy

Tear down everything this config manages.

terraform destroy -target=<addr>

Destroy a single resource.

terraform apply -replace=<addr>

Force-recreate one resource (replaces old taint).

Format & validateBeginner

terraform fmt

Rewrite files to canonical style.

terraform fmt -recursive -check

Fail (exit 3) if any file is unformatted — for CI.

terraform validate

Check syntax and internal consistency (no cloud calls).

Success! The configuration is valid.

terraform plan -detailed-exitcode

0 = no changes, 1 = error, 2 = drift. Perfect gate.

terraform console

Interactive REPL to test expressions against state.

> upper("prod")
"PROD"
> length(var.subnets)
3

Variables & outputsIntermediate

terraform apply -var="region=us-east-1"

Set one variable on the command line.

terraform apply -var-file=prod.tfvars

Feed a whole environment’s variables.

export TF_VAR_region=us-east-1

Set a variable via the environment.

terraform output

Print all root output values.

terraform output -raw db_endpoint

Print one output unquoted (for scripts).

db.prod.internal:5432

terraform output -json

Machine-readable outputs for pipelines.

Inspect stateIntermediate

terraform state list

List every resource address in state.

aws_instance.web
aws_security_group.web
module.vpc.aws_vpc.this

terraform state show <addr>

Show one resource’s recorded attributes.

terraform show

Human-readable dump of current state or a plan.

terraform show -json tfplan

JSON of a saved plan (feed to OPA/Conftest).

terraform graph | dot -Tsvg > g.svg

Render the dependency graph.

terraform refresh

Reconcile state with real infra (now: apply -refresh-only).

State surgeryAdvanced

terraform state mv <a> <b>

Rename/move a resource without recreating it.

terraform state mv <a> module.m.<a>

Move a resource into a module.

terraform state rm <addr>

Forget a resource (leaves the real thing alone).

terraform state pull > state.json

Download remote state to a local file.

terraform state push state.json

Overwrite remote state (dangerous — back up first).

terraform force-unlock <LOCK_ID>

Release a stuck state lock.

Import & movedAdvanced

terraform import <addr> <cloud-id>

Bring an existing resource under management.

terraform import aws_instance.web i-0abcd1234
Import successful!

import { to = aws_s3_bucket.b id = "my-bucket" }

Declarative import block (plan generates it).

terraform plan -generate-config-out=gen.tf

Generate HCL for imported resources.

moved { from = aws_instance.a to = aws_instance.b }

Refactor addresses with no state mv command.

WorkspacesIntermediate

terraform workspace list

List workspaces (* marks the active one).

  default
* staging
  prod

terraform workspace new prod

Create and switch to an isolated state workspace.

terraform workspace select prod

Switch the active workspace.

terraform.workspace

Interpolation for the current workspace name in HCL.

Debug & maintenanceAdvanced

TF_LOG=DEBUG terraform apply

Verbose logs (TRACE/DEBUG/INFO/WARN/ERROR).

TF_LOG_PATH=tf.log TF_LOG=TRACE terraform plan

Send trace logs to a file.

terraform providers

Tree of provider requirements across modules.

terraform providers lock -platform=linux_amd64

Add checksums for another OS to the lock file.

terraform taint <addr>

Mark for recreation (legacy — prefer -replace).

terraform test

Run .tftest.hcl assertions (native testing, 1.6+).

Go deeper

Full, hands-on DevSecOps courses

Browse courses