Terraform Cheatsheet - Infrastructure as Code Command Reference
Essential Terraform IaC commands for the complete lifecycle from init to destroy, organized by scenario. Copy directly for your infrastructure.
Back to SysOpsCore Workflow 7
terraform init初始化工作Directory，下载 Provider 和module
terraform plan预览变更，Display将Create/修改/销毁的资源
terraform applyExecute变更，应用基础设施修改
terraform destroy销毁所有由Configure管理的基础设施
terraform fmt格式化 .tf File为标准格式
terraform validate验证ConfigureFile语法和内部一致性
terraform apply -auto-approve自动批准Execute（CI/CD 使用）
State Management 9
terraform state listListstateFile中所有资源
terraform state show <resource>Show指定资源的verbosestate
terraform state mv <src> <dst>Move资源在state中的地址
terraform state rm <resource>从state中Remove资源（不销毁实际资源）
terraform state pull拉取远程state到本地 stdout
terraform state push推送本地state到远程后端
terraform import <address> <id>将已有资源Import Terraform 管理
terraform taint <resource>标记资源为"损坏"，下次 apply 会重建
terraform untaint <resource>取消资源的"损坏"标记
Variables & Outputs 8
variable "region" {\n type = string\n default = "us-east-1"\n}定义variable（type、default）
var.region引用已定义的variable
TF_VAR_region=us-west-2通过env varSetvariable
terraform plan -var="region=us-west-2"通过命令行OptionsSetvariable
output "ip" {\n value = aws_instance.web.public_ip\n}定义Output值
terraform outputShow所有Output值
terraform output -json以 JSON 格式ShowOutput值
locals {\n name = "${var.prefix}-web"\n}本地局部variable，简化表达式
Modules 6
module "vpc" {\n source = "terraform-aws-modules/vpc/aws"\n version = "5.0.0"\n}引用 Registry module，指定版本
module "vpc" {\n source = "./modules/vpc"\n}引用本地module（相对路径）
module "vpc" {\n source = "git::https://example.com/vpc.git"\n}引用 Git 仓库中的module
module.vpc.vpc_id引用module的Output值
terraform init -upgradeUpgrademodule至最新允许版本
terraform get下载和Updatemodule
Remote Backends 6
terraform {\n backend "s3" {\n bucket = "my-tf-state"\n key = "prod/terraform.tfstate"\n region = "us-east-1"\n }\n}S3 后端存储stateFile
terraform {\n backend "s3" {\n dynamodb_table = "tf-lock"\n }\n}DynamoDB state锁防concurrency
data "terraform_remote_state" "db" {\n backend = "s3"\n config = {\n bucket = "shared-state"\n key = "db/terraform.tfstate"\n }\n}跨ConfigureRead远程state
data.terraform_remote_state.db.outputs.db_endpoint引用远程state的Output值
terraform init -reconfigure重新Configure后端（migratestate）
terraform init -migrate-state将stateFilemigrate到新后端
Advanced Features 9
terraform workspace new stagingCreate新的工作空间
terraform workspace listList所有工作空间
terraform workspace select staging切换到指定工作空间
resource "aws_instance" "web" {\n for_each = var.subnets\n}for_each 通过setbatchCreate资源
resource "aws_instance" "web" {\n count = var.instance_count\n}count 通过计数batchCreate资源
depends_on = [aws_s3_bucket.data]显式dependencies，确保Createorder
lifecycle {\n create_before_destroy = true\n}生命periodic策略：先Create后销毁
lifecycle {\n prevent_destroy = true\n}生命periodic策略：防止意外销毁
lifecycle {\n ignore_changes = [tags]\n}生命periodic策略：忽略特定property变更
Debugging 8
terraform consoleinteractive控制台，Test表达式
terraform graph | dot -Tpng > graph.png生成资源dependencies关系图
terraform showShow当前state的可读Output
terraform show -jsonJSON 格式Outputstate，方便 jq 处理
TF_LOG=DEBUG terraform apply开启 DEBUG 级别日志Output
TF_LOG=TRACE terraform planTRACE 级别日志，最verbose信息
TF_LOG_PATH=./tf.log terraform apply将日志Output到指定File
export TF_LOG=WARNSetlog level（TRACE/DEBUG/INFO/WARN/ERROR）
💡 Tips
- terraform plan never modifies resources, safe to run anytime
- Store sensitive values in variables, never hardcode in .tf files
- Use terraform fmt to standardize code format across your team
- State files contain sensitive information, never commit to Git
- Use remote backends (S3 + DynamoDB) for team collaboration and state locking
Official References
Commands are compiled from the official docs below. Click to verify the latest usage.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Found an error? Report it
Wrong command or description? Open an issue to help us fix it.
Found an error? Report it