Terraform Cheatsheet

Commands

Use this Terraform reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Core Workflow Commands

Command	What it does
`terraform init`	initialize directory, download providers and modules
`terraform validate`	check config syntax and internal consistency
`terraform plan`	show what changes will be made
`terraform apply`	apply the planned changes
`terraform destroy`	destroy all managed infrastructure

terraform init
terraform plan -out=plan.tfplan     # save plan to file
terraform apply plan.tfplan         # apply exact saved plan (no prompt)
terraform apply -auto-approve       # skip confirmation (CI use)
terraform destroy -auto-approve

init Flags

Flag	Description
`-upgrade`	upgrade providers to latest allowed version
`-reconfigure`	ignore existing backend config (force re-init)
`-migrate-state`	migrate state to new backend
`-backend=false`	skip backend initialization
`-backend-config=file.hcl`	load partial backend config from file
`-backend-config="key=val"`	supply individual backend config values

plan Flags

Flag	Description
`-out=plan.tfplan`	save plan to file for `apply`
`-var="key=val"`	set a single variable
`-var-file=file.tfvars`	load variables from file
`-target=resource.addr`	plan only this resource (and deps)
`-refresh=false`	skip reading real infra state
`-refresh-only`	plan to sync state with real infra only
`-destroy`	plan a destroy operation
`-compact-warnings`	condense warning output
`-json`	machine-readable JSON output
`-generate-config-out=file.tf`	generate HCL for `import` blocks

apply Flags

Flag	Description
`-auto-approve`	skip interactive confirmation
`-var="key=val"`	set a variable
`-var-file=file.tfvars`	load variables from file
`-target=resource.addr`	apply only this resource (and deps)
`-refresh=false`	don't refresh state before apply
`-replace=resource.addr`	force replacement of a specific resource
`-parallelism=N`	concurrent operations (default: 10)
`-json`	JSON output (for CI parsing)

# Force replace a specific resource
terraform apply -replace="aws_instance.web"

# Apply with variables
terraform apply -var="environment=prod" -var-file="prod.tfvars"

# Target a specific resource and its deps
terraform apply -target="module.vpc"

destroy Flags

terraform destroy                         # destroy all (prompts)
terraform destroy -auto-approve           # no prompt
terraform destroy -target=aws_instance.web  # destroy one resource

State Commands

Command	Description
`terraform show`	human-readable current state
`terraform show -json`	JSON state dump
`terraform state list`	list all resource addresses
`terraform state show <addr>`	show attributes of one resource
`terraform state mv <src> <dst>`	rename resource in state
`terraform state rm <addr>`	remove resource from state
`terraform state pull`	print remote state to stdout
`terraform state push <file>`	push local state to remote
`terraform refresh`	sync state with real infra
`terraform force-unlock <id>`	release a stuck state lock

terraform state list
terraform state show aws_instance.web
terraform state mv aws_instance.old aws_instance.new
terraform state rm aws_s3_bucket.legacy
terraform state pull > backup-$(date +%Y%m%d).tfstate

Import Commands

# CLI import (classic)
terraform import aws_instance.web i-0abc1234def56789

# Generate config for imported resources (1.5+)
terraform plan -generate-config-out=imported.tf

Workspace Commands

terraform workspace list
terraform workspace new <name>
terraform workspace select <name>
terraform workspace show
terraform workspace delete <name>

Format and Validate

terraform fmt                    # format all .tf files in current dir
terraform fmt -recursive         # format recursively
terraform fmt -check             # exit 1 if formatting needed (CI)
terraform fmt -diff              # show diff instead of writing
terraform validate               # syntax + config validation

Providers and Modules

terraform providers              # list providers in current config
terraform providers schema -json # dump full provider schema
terraform providers lock \
  -platform=linux_amd64 \
  -platform=darwin_arm64         # add multi-platform lock hashes
terraform get                    # download modules only
terraform get -update            # re-download modules

Output Commands

terraform output                          # all outputs
terraform output <name>                   # one output
terraform output -json                    # JSON (all outputs)
terraform output -raw <name>              # raw string value

Graph

terraform graph                           # emit dependency graph (DOT format)
terraform graph | dot -Tsvg > graph.svg   # render to SVG
terraform graph -type=plan                # plan dependency graph

Console (REPL)

terraform console                # interactive expression evaluator
> cidrsubnet("10.0.0.0/16", 8, 2)
"10.0.2.0/24"
> length(["a", "b", "c"])
3
> jsondecode("{\"key\":\"val\"}")
{ "key" = "val" }
# Ctrl-C or Ctrl-D to exit

Environment Variables

Variable	Effect
`TF_VAR_<name>`	set input variable
`TF_LOG`	log level: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
`TF_LOG_PATH`	write logs to file
`TF_CLI_ARGS`	default args for all commands
`TF_CLI_ARGS_plan`	default args for `plan` only
`TF_CLI_ARGS_apply`	default args for `apply` only
`TF_DATA_DIR`	override `.terraform` directory
`TF_WORKSPACE`	set workspace at startup
`TF_IN_AUTOMATION`	suppress interactive prompts/hints
`TF_INPUT`	set to `0` to disable interactive prompts
`TF_PLUGIN_CACHE_DIR`	share provider cache across projects

export TF_LOG=DEBUG
export TF_LOG_PATH=/tmp/terraform.log
export TF_IN_AUTOMATION=true
export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"

CI/CD Checklist

terraform init -input=false
terraform validate
terraform fmt -check -recursive
terraform plan -input=false -out=plan.tfplan
terraform apply -input=false plan.tfplan