The Terraform command cheat sheet

Quick reference

Init

$terraform init
$terraform init -upgrade
$terraform init -reconfigure
$terraform providers
$terraform version

Plan

$terraform plan -out=tfplan
$terraform plan -var-file=prod.tfvars
$terraform show -no-color tfplan
$terraform validate
$terraform fmt -check -recursive

State

$terraform state list
$terraform state show aws_instance.api
$terraform state pull
$terraform state mv module.old module.new
$terraform apply -refresh-only

Import

$terraform import aws_s3_bucket.logs logs
$terraform plan -generate-config-out=gen.tf
$terraform state list | grep logs
$terraform plan -target=aws_s3_bucket.logs
$terraform state rm aws_s3_bucket.logs

Explained

Init

Init prepares the directory: downloads providers, writes the lock file. -upgrade moves to the newest allowed versions, -reconfigure forgets a moved backend. terraform providers lists what is installed, and terraform version names the binary.

Plan

Plan shows what would change. -out=tfplan records the decision for the apply, -var-file picks production values. show -no-color prints it for a pull request, validate catches type errors, and fmt -check -recursive fails CI on unformatted files.

State

State maps configuration to real resources. state list names the addresses, state show reads one, state pull prints the file. state mv moves an address without touching the cloud, and apply -refresh-only updates state from reality without changing infrastructure.

Import

Import adopts what already exists. terraform import aws_s3_bucket.logs logs writes it into state, plan -generate-config-out=gen.tf writes matching HCL, state list | grep logs confirms it, and state rm drops it from state without deleting the bucket.

In one line

Review the plan

$terraform show -no-color tfplan