Grep the state list

Filter managed addresses to find what TF tracks before surgery

terraform state list | grep -i 'aws_iam'
tool
terraform43 commands
tags
terraformtroubleshootingsecurity

More terraform commands

  • Config-driven import block
    cat > import.tf <<'EOF' import { to = aws_instance.web id = "<id>" } EOF terraform plan -generate-config-out=generated.tf

    Declarative import; -generate-config-out scaffolds HCL for the imported object

  • Refactor with moved block
    cat >> moved.tf <<'EOF' moved { from = aws_instance.web to = aws_instance.app } EOF

    Rename addresses in code with no destroy/recreate; survives in version control

  • Replace resource (modern taint)
    terraform apply -replace='aws_instance.web'

    Force destroy+recreate of one resource; replaces deprecated terraform taint

  • Surgical targeted plan
    terraform plan -target='module.db.aws_db_instance.main'

    Limit plan to one address; note: -target is an escape hatch, can mask drift

  • Refresh-only plan (detect drift)
    terraform plan -refresh-only

    Sync state to real infra without proposing changes; surfaces out-of-band drift

all 43 terraform commands