Use with the Terraform series starting at Infrastructure as Code with Terraform. Narrative detail lives in the chapter links below each section.
Setup and init
| Command | Purpose |
|---|---|
terraform version |
Show CLI version |
terraform init |
Download providers and modules; configure backend |
terraform init -upgrade |
Upgrade provider and module versions within constraints |
terraform init -backend=false |
Init without configuring remote backend (CI validate) |
terraform init -migrate-state |
Reconfigure backend and migrate state (when prompted) |
terraform providers |
List required providers |
See Getting started with Terraform on Google Cloud.
Write and check
| Command | Purpose |
|---|---|
terraform fmt -recursive |
Format .tf and .tfvars files |
terraform fmt -check -recursive |
Fail if formatting needed (CI) |
terraform validate |
Check syntax and internal consistency (after init) |
terraform console |
Evaluate expressions interactively |
terraform graph |
Dependency graph (Graphviz DOT) |
See Formatting and validating Terraform files.
Plan and apply
| Command | Purpose |
|---|---|
terraform plan |
Preview changes |
terraform plan -out=plan.tfplan |
Save plan for reviewed apply |
terraform apply |
Apply changes (prompts to confirm) |
terraform apply plan.tfplan |
Apply saved plan exactly |
terraform apply -auto-approve |
Apply without prompt (CI only with care) |
terraform apply -var="name=value" |
Set input variable on CLI |
terraform apply -var-file=prod.tfvars |
Load variable file |
terraform plan -target=ADDR |
Limit plan to one resource address |
terraform plan -replace=ADDR |
Force replace on next apply |
terraform plan -refresh-only |
Refresh state only; no resource changes |
terraform apply -destroy |
Destroy all managed resources |
terraform destroy |
Same as apply -destroy |
State
| Command | Purpose |
|---|---|
terraform state list |
Addresses in state |
terraform state show ADDR |
One resource in state |
terraform state mv SRC DST |
Rename address in state |
terraform state rm ADDR |
Stop managing without destroy |
terraform show |
Human-readable state or plan |
terraform output |
Print root outputs |
terraform output NAME |
One output value |
Import and refactor
| Command | Purpose |
|---|---|
terraform import ADDR ID |
Import existing resource (CLI) |
import { ... } block |
Declare import in configuration (plan then apply) |
moved { ... } block |
Retarget state after rename or module refactor |
removed { ... } block |
Remove from config; optional destroy |
See Terraform modules and State data in Terraform.
Workspaces
| Command | Purpose |
|---|---|
terraform workspace list |
List workspaces |
terraform workspace select NAME |
Switch workspace |
terraform workspace new NAME |
Create workspace |
Providers and GCP environment
| Variable / setting | Purpose |
|---|---|
GOOGLE_PROJECT / GOOGLE_CLOUD_PROJECT |
Default GCP project |
GOOGLE_REGION / GOOGLE_ZONE |
Default region or zone |
GOOGLE_APPLICATION_CREDENTIALS |
Path to service account JSON (ADC) |
TF_VAR_name |
Set input variable name |
TF_LOG=DEBUG |
Verbose Terraform logs |
TF_CLI_ARGS_plan="-no-color" |
Extra args for plan subcommand |
TF_IN_AUTOMATION=true |
Adjust output for CI |
See Infrastructure as Code with Terraform (GCP authentication).
Deep dives: HCL structure in Terraform, Terraform vs OpenTofu and alternatives.