🏗️
Terraform cheat sheet
Terraform describes infrastructure as code. The core loop is init, plan, apply. Always read the plan before applying, especially anything that says destroy or replace. OpenTofu uses the same commands with tofu.
Click any command to copy it.
Core workflow
| Command | What it does |
|---|---|
terraform init | Download providers and modules, set up the backend. |
terraform init -upgrade | Upgrade providers within version constraints. |
terraform fmt -recursive | Format all .tf files. |
terraform validate | Check the configuration for errors. |
terraform plan | Preview the changes. |
terraform plan -out=tfplan | Save the plan so apply runs exactly what you reviewed. |
terraform apply tfplan | Apply a saved plan. |
terraform apply | Plan and apply after confirmation. |
Variables and outputs
| Command | What it does |
|---|---|
terraform plan -var "region=eu-west-1" | Set a variable on the command line. |
terraform plan -var-file=prod.tfvars | Load variables from a file. |
terraform output | Show output values. |
terraform output -json | Outputs as JSON for scripts. |
terraform output -raw name | Print one output with no quotes. |
export TF_VAR_name=value | Set a variable through the environment. |
State
| Command | What it does |
|---|---|
terraform state list | List resources in the state. |
terraform state show aws_instance.web | Show one resource's attributes. |
terraform state mv old.name new.name | Rename a resource in state without recreating it. |
terraform import aws_instance.web i-0abc123 | Bring an existing resource under Terraform management. |
terraform state rm aws_instance.web | Destructive: Forget a resource without destroying it; Terraform may try to create a duplicate. |
terraform apply -refresh-only | Update state to match real infrastructure. |
terraform force-unlock LOCK_ID | Destructive: Release a stuck state lock. Only if you are sure no other run is active. |
Targeted and destructive
| Command | What it does |
|---|---|
terraform apply -replace=aws_instance.web | Destructive: Force a resource to be destroyed and recreated (replaces the old taint command). |
terraform apply -target=aws_instance.web | Apply only one resource (use sparingly). |
terraform apply -auto-approve | Destructive: Apply without confirmation. Use only in reviewed automation. |
terraform destroy | Destructive: Destroy everything in the configuration. |
terraform destroy -target=aws_instance.web | Destructive: Destroy one resource. |
Workspaces and debugging
| Command | What it does |
|---|---|
terraform workspace list | List workspaces. |
terraform workspace new staging | Create a workspace. |
terraform workspace select staging | Switch workspace. |
terraform console | Evaluate expressions interactively. |
terraform show | Show the current state or a saved plan. |
terraform providers | List required providers. |
TF_LOG=DEBUG terraform plan | Enable detailed logging. |
terraform version | Show Terraform and provider versions. |
Frequently asked questions
What is the difference between plan and apply?
plan only shows what would change. apply makes the changes. Saving a plan with -out and applying that file guarantees you apply exactly what you reviewed.
How do I recover from a corrupted or lost state?
Use a remote backend with versioning (such as an S3 bucket with versioning) so you can restore an earlier state file; terraform import can rebuild entries for existing resources.