tofu

What it does

How to write it

tofu COMMAND [OPTIONS]

Main parts

Commands

init

Download providers and modules, set up the backend.

fmt / validate

Format code / check syntax.

plan [-out FILE]

Show the changes.

apply [FILE]

Make the changes.

destroy

Delete everything in the state.

output [NAME]

Show outputs.

state list|show|mv|rm

Work with the state.

import ADDR ID

Take an existing resource into the state.

workspace list|new|select

Several states for one config.

test

Run .tftest.hcl tests.

providers lock

Write provider checksums for all platforms.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1The normal workflow

   $tofu init
   $tofu fmt -recursive && tofu validate
   $tofu plan -out tfplan
   $tofu apply tfplan

2. 2Move a Terraform project to OpenTofu

   $terraform version
   $tofu init -upgrade
   $tofu plan

   The plan should show no changes. Make a backup of the state first.

3. 3Encrypt the state with a key from an environment variable

   $cat encryption.tf
   terraform {
     encryption {
       key_provider "pbkdf2" "main" { passphrase = var.state_passphrase }
       method "aes_gcm" "main" { keys = key_provider.pbkdf2.main }
       state { method = method.aes_gcm.main }
     }
   }

4. 4Variables per environment

   $tofu plan -var-file envs/prod.tfvars -out tfplan

5. 5Find drift

   $tofu plan -refresh-only

6. 6Read an output in a script

   $tofu output -raw lb_ip

7. 7Import an existing resource

   $tofu import azurerm_resource_group.main /subscriptions/SUB/resourceGroups/rg-shop

8. 8List and move state

   $tofu state list
   $tofu state mv azurerm_storage_account.old azurerm_storage_account.logs

9. 9Run tests

   $tofu test

10. 10Lock providers for Linux and Mac

    $tofu providers lock -platform=linux_amd64 -platform=darwin_arm64

11. 11In CI

    $tofu init -input=false
    $tofu plan -input=false -no-color -out tfplan

Nothing matches this filter.

Files

*.tf / *.tofu

The code (.tofu files are read only by OpenTofu).

.terraform.lock.hcl

Provider versions and checksums.

Exit codes