terraform
43 commands
43 shown
Plan with var file
Show changes; save plan artifact for CI gating
terraform plan -var-file=prod.tfvars -out=plan.tfplan
Apply a saved plan
Apply exactly the previously generated plan — no interactive prompts
terraform apply plan.tfplan
Import existing resource
Bring an already-existing resource under Terraform control
terraform import module.path.resource_type.name <remote-id>
Show state for a resource
Inspect Terraform state attributes for a single resource
terraform state show module.path.resource_type.name
Move resource in state
Rename/reorganize resource without destroying and recreating it
terraform state mv old.address new.address
Workspace list
Show all workspaces; current one marked with *
terraform workspace list
Create and switch workspace
Create a new workspace and switch to it
terraform workspace new staging && terraform workspace select staging
Validate configuration
Check Terraform configuration for syntax and consistency errors
terraform validate
Format code
Auto-format all .tf files recursively
terraform fmt -recursive
Show output values
Print all outputs as JSON; useful for pipeline scripting
terraform output -json
Destroy specific resource
Destroy a single resource without touching everything else
terraform destroy -target=module.vpc.aws_vpc.main
Taint resource (force replace)
Mark resource for replacement on next apply
terraform taint module.eks.aws_instance.node
Remove resource from state
Forget a resource from state without destroying it in cloud
terraform state rm module.path.resource_type.name
Refresh state
Update state file to match real infrastructure
terraform refresh -var-file=prod.tfvars
Graph dependency tree
Visualize resource dependency graph (requires Graphviz)
terraform graph | dot -Tsvg > graph.svg
List state resources
Filter state resources by pattern
terraform state list | grep <pattern>
Format all files
Recursively format all .tf files in subdirectories
terraform fmt -recursive
Validate configuration
Check configuration syntax without accessing remote state
terraform validate
Plan with var file
Generate plan with prod variables, save to file
terraform plan -var-file=prod.tfvars -out=prod.tfplan
Apply saved plan
Apply exactly the plan generated earlier (no re-prompts)
terraform apply prod.tfplan
Show resource in state
Display all attributes of a specific resource in state
terraform state show 'aws_instance.web[0]'
Move resource in state
Rename or move a resource without destroying it
terraform state mv 'aws_instance.web' 'module.app.aws_instance.web'
Import existing resource
Bring an existing resource under Terraform management
terraform import 'aws_s3_bucket.mybucket' my-existing-bucket
Taint resource for recreation
Mark resource to be destroyed and recreated on next apply
terraform taint 'aws_instance.web[0]'
Remove resource from state
Remove a resource from state without destroying it in the cloud
terraform state rm 'aws_instance.legacy'
Show outputs
Print all outputs as compact JSON
terraform output -json | jq 'to_entries[] | {(.key): .value.value}'
Destroy specific resource
Destroy a single resource without full plan
terraform destroy -target='aws_instance.web' -auto-approve
Unlock stuck state
Release a stuck state lock after a failed apply
terraform force-unlock <lock-id>
Workspace create and switch
Create and activate a Terraform workspace
terraform workspace new staging && terraform workspace select staging
Show dependency graph
Render resource dependency graph as SVG (requires graphviz)
terraform graph | dot -Tsvg > graph.svg && open graph.svg
List providers with versions
Lock provider versions for multiple platforms in .terraform.lock.hcl
terraform providers lock -platform=linux_amd64 -platform=darwin_arm64
Move resource in state
Rename/refactor address without destroy; prefer moved{} block in newer TF
terraform state mv 'aws_instance.web' 'aws_instance.app'
Remove orphan from state
Forget resource from state without deleting real infra; note: object keeps existing
terraform state rm 'aws_s3_bucket.legacy'
Inspect single resource state
Dump all attributes of one resolved address for drift/debug investigation
terraform state show 'module.vpc.aws_subnet.private[0]'
Grep the state list
Filter managed addresses to find what TF tracks before surgery
terraform state list | grep -i 'aws_iam'
Config-driven import block
Declarative import; -generate-config-out scaffolds HCL for the imported object
cat > import.tf <<'EOF'
import {
to = aws_instance.web
id = "<id>"
}
EOF
terraform plan -generate-config-out=generated.tf
Refactor with moved block
Rename addresses in code with no destroy/recreate; survives in version control
cat >> moved.tf <<'EOF'
moved {
from = aws_instance.web
to = aws_instance.app
}
EOF
Replace resource (modern taint)
Force destroy+recreate of one resource; replaces deprecated terraform taint
terraform apply -replace='aws_instance.web'
Surgical targeted plan
Limit plan to one address; note: -target is an escape hatch, can mask drift
terraform plan -target='module.db.aws_db_instance.main'
Refresh-only plan (detect drift)
Sync state to real infra without proposing changes; surfaces out-of-band drift
terraform plan -refresh-only
Migrate backend on init
Move state to a new backend; use -reconfigure to skip migration and reset
terraform init -migrate-state -backend-config=backend.hcl
Query outputs with jq
Pipe machine-readable outputs into jq for scripting and downstream wiring
terraform output -json | jq -r '.endpoints.value[]'
Trace plan with TF_LOG
Capture provider/API debug to a file; use TRACE for the most verbose level
TF_LOG=DEBUG TF_LOG_PATH=tf.log terraform plan
no commands match