Toolbox · Infrastructure as Code
Terraform Commands
Plan/apply workflow, state operations, targeting, imports and drift checks.
On this page
Workflow
| Command | Purpose |
|---|---|
terraform init -backend-config=backend.hcl -upgrade | Init with backend, upgrade providers |
terraform fmt -recursive -check | Formatting gate |
terraform validate | Syntax/semantic check |
terraform plan -out=tfplan | Saved plan |
terraform show -json tfplan > plan.json | Machine-readable plan for policy checks |
terraform apply tfplan | Apply exactly what was reviewed |
terraform plan -detailed-exitcode | Exit 2 when changes exist (drift detection) |
State
| Command | Purpose |
|---|---|
terraform state list | Resources in state |
terraform state show aws_s3_bucket.logs | Attributes |
terraform state mv old.name new.name | Rename without recreate |
terraform state rm module.legacy | Caution forget a resource in shared state (does not delete it) |
terraform import aws_s3_bucket.logs my-bucket | Adopt existing resource |
terraform force-unlock <id> | Caution clear a stale lock; be sure no apply is running |
Targeting and troubleshooting
| Command | Purpose |
|---|---|
terraform plan -target=module.network | Limit scope (temporary use only) |
terraform apply -replace=aws_instance.web | Destructive destroy and recreate the resource |
terraform taint aws_instance.web | Legacy (deprecated since 0.15.2); use -replace |
TF_LOG=DEBUG terraform plan | Provider debug logs |
terraform providers lock -platform=linux_amd64 | Lock hashes for CI platform |
Workspaces and outputs
| Command | Purpose |
|---|---|
terraform workspace list / select prod | Workspaces |
terraform output -json | Outputs for scripts |
terraform graph | dot -Tsvg > graph.svg | Dependency graph |
See also
- Secure Terraform Foundations and the rest of the Infrastructure as Code Security path: pinning, state, secrets and a Checkov gate in the merge request.