Terraform Cheatsheet

Initialize the working directory, download providers, and configure the backend.

💡 Run this first after cloning a repo or changing provider and backend settings.

Reinitialize the directory and upgrade providers and modules to newer allowed versions.

Initialize Terraform using backend settings from an external configuration file.

Check whether the current Terraform configuration is syntactically valid and internally consistent.

💡 Use this in CI before planning to catch broken references fast.

Format Terraform files in the current directory to the canonical style.

Format all Terraform files recursively across modules and environment folders.

Create an execution plan showing what Terraform will add, change, or destroy.

💡 Review plans carefully in production to avoid unintended replacements.

Save the generated plan to a file for later review or controlled apply.

Apply the current execution plan and reconcile infrastructure to the configuration.

Apply a previously saved plan file to ensure exactly reviewed changes are executed.

💡 Use saved plans in deployment pipelines to separate review from execution.

Apply changes without an interactive approval prompt.

Generate and execute a plan that destroys all managed resources in the current workspace.

💡 Always verify the active workspace before destroying shared environments.

Destroy all managed resources without asking for confirmation.

List all resources currently tracked in the Terraform state file.

💡 Pair this with grep when auditing large stacks for a specific module or resource type.

Display the attributes of a single resource as stored in state.

Move a resource address in state without recreating the underlying infrastructure.

💡 Use this during refactors to preserve resources when introducing modules.

Remove a resource from state without destroying the real infrastructure object.

Download and print the latest remote state to standard output.

Upload a local state file to the configured backend.

💡 Back up state before pushing and coordinate carefully to avoid overwriting newer remote state.

Rewrite provider references in state when migrating resources to a new provider source.

Import an existing infrastructure object into Terraform state under a declared resource.

💡 Define the resource block first so the imported object can be managed cleanly afterward.

Update state with the real infrastructure data from providers without changing configuration.

Manually remove a state lock when a previous run exited unexpectedly.

💡 Only unlock after confirming no active plan or apply is still using the state.

List all available workspaces and mark the currently selected one.

Create a new workspace with isolated state for a new environment.

💡 Standardize workspace names across repositories so automation stays predictable.

Switch the active workspace for future plan and apply operations.

Print the name of the currently selected workspace.

Delete an unused workspace after its state is no longer needed.

Pass a single input variable inline while generating a plan.

Load input variables from a tfvars file for a specific environment.

💡 Keep common defaults in variables and environment overrides in versioned tfvars files.

Apply infrastructure changes using an inline variable override.

Show all root module outputs after an apply completes.

Print a single named output value from the current state.

Render all outputs as JSON for scripts, pipelines or tooling integrations.

💡 Prefer JSON output when feeding values into deployment scripts or automation.

Print a single output as raw text without quotes or JSON formatting.

Download child modules referenced by the current configuration.

Re-download child modules and update them to newer allowed versions.

💡 Review module changelogs before updating shared VPC, EKS or networking modules.

Initialize the working directory and download required providers and modules.

Preview changes for a specific module without planning the whole stack.

Apply changes only for a selected module when performing controlled partial operations.

💡 Targeting is useful for break-glass fixes, but a full follow-up plan should always be reviewed.

Create a plan limited to a specific resource address.

Apply only the changes needed for a single targeted resource.

💡 Use targeting sparingly because it can bypass normal dependency evaluation across the stack.

Destroy one targeted resource without tearing down the entire workspace.

Force Terraform to replace a specific resource during apply.

💡 Prefer -replace over taint for explicit, reviewable replacement workflows.

Generate a plan without refreshing remote object state first.

Control how many resource operations Terraform performs concurrently during apply.

Run a plan with debug logging enabled for provider and backend troubleshooting.

💡 DEBUG is usually detailed enough without the noise and size of TRACE logs.

Run an apply with full trace logging to diagnose complex provider behavior.

Write Terraform debug logs to a file instead of flooding standard output.

Display the current state or a human-readable representation of Terraform data.

Render the contents of a saved plan file for review before apply.

Convert a saved plan to JSON for machine analysis, policy checks or drift tooling.

💡 JSON plans are ideal for CI gates, cost estimation and policy-as-code checks.

Generate a dependency graph of resources and modules in DOT format.

Render the Terraform dependency graph to a PNG for architecture review.

Show the installed Terraform CLI version and platform details.

List the providers required by the current configuration and modules.

Generate or update dependency lock entries for provider checksums across platforms.

💡 Commit provider lock files so teams and CI use verified provider builds consistently.

Authenticate the Terraform CLI with Terraform Cloud or HCP Terraform.

💡 This stores an API token locally so remote runs and private module access can succeed.

Remove locally stored Terraform Cloud credentials for the current hostname.

Show the Terraform Cloud user associated with the current authenticated token.

List remote workspaces when using a Terraform Cloud or remote backend.

Release a stuck remote state lock after verifying no run is still active.

Mark a resource as tainted so Terraform recreates it on the next apply.

💡 Deprecated in newer workflows; prefer terraform apply -replace for explicit replacement intent.

Remove the tainted marker from a resource so Terraform stops forcing replacement.