Inspect single resource state

Dump all attributes of one resolved address for drift/debug investigation

terraform state show 'module.vpc.aws_subnet.private[0]'
tool
terraform43 commands
tags
terraformdebugtroubleshooting

More terraform commands

  • Grep the state list
    terraform state list | grep -i 'aws_iam'

    Filter managed addresses to find what TF tracks before surgery

  • Config-driven import block
    cat > import.tf <<'EOF' import { to = aws_instance.web id = "<id>" } EOF terraform plan -generate-config-out=generated.tf

    Declarative import; -generate-config-out scaffolds HCL for the imported object

  • Refactor with moved block
    cat >> moved.tf <<'EOF' moved { from = aws_instance.web to = aws_instance.app } EOF

    Rename addresses in code with no destroy/recreate; survives in version control

  • Replace resource (modern taint)
    terraform apply -replace='aws_instance.web'

    Force destroy+recreate of one resource; replaces deprecated terraform taint

  • Surgical targeted plan
    terraform plan -target='module.db.aws_db_instance.main'

    Limit plan to one address; note: -target is an escape hatch, can mask drift

all 43 terraform commands