Terraform Cheatsheet - Infrastructure as Code Command Reference

Terraform's mental model is three storage layers — code in HCL, config through variables and backend, and the live state describing what actually exists. plan versus apply is the rhythm you operate on: plan previews the diff, apply makes it real, and destroy has to be deliberate. This table pairs each command with the state/backend knowledge it depends on so the workflow clicks instead of confusing.

SysOps·53 commands·Last updated 2026-07-21

Core Workflow 7

terraform init

Initialize the working dir; download providers and modules

terraform plan

Preview changes: resources to create/modify/destroy

terraform apply

Apply changes to infrastructure

terraform destroy

Destroy all managed infrastructure

terraform fmt

Format .tf files to the standard style

terraform validate

Validate config syntax and internal consistency

terraform apply -auto-approve

Auto-approve (for CI/CD)

State Management 9

terraform state list

List all resources in the state file

terraform state show <resource>

Show detailed state of a resource

terraform state mv <src> <dst>

Move a resource's address in state

terraform state rm <resource>

Remove a resource from state (keeps the real one)

terraform state pull

Pull remote state to local stdout

terraform state push

Push local state to the remote backend

terraform import <address> <id>

Import an existing resource into Terraform

terraform taint <resource>

Mark a resource as 'tainted'; rebuilt on next apply

terraform untaint <resource>

Clear the 'tainted' mark

Variables & Outputs 8

variable "region" {\n type = string\n default = "us-east-1"\n}

Define a variable (type, default)

var.region

Reference a defined variable

TF_VAR_region=us-west-2

Set a variable via environment variable

terraform plan -var="region=us-west-2"

Set a variable via CLI flag

output "ip" {\n value = aws_instance.web.public_ip\n}

Define an output value

terraform output

Show all output values

terraform output -json

Show outputs as JSON

locals {\n name = "${var.prefix}-web"\n}

Local values to simplify expressions

Modules 6

module "vpc" {\n source = "terraform-aws-modules/vpc/aws"\n version = "5.0.0"\n}

Reference a Registry module, pin version

module "vpc" {\n source = "./modules/vpc"\n}

Reference a local module (relative path)

module "vpc" {\n source = "git::https://example.com/vpc.git"\n}

Reference a module in a Git repo

module.vpc.vpc_id

Reference a module's output

terraform init -upgrade

Upgrade modules to the latest allowed version

terraform get

Download and update modules

Remote Backends 6

terraform {\n  backend "s3" {\n    bucket = "my-tf-state"\n    key = "prod/terraform.tfstate"\n    region = "us-east-1"\n  }\n}

Store state in an S3 backend

terraform {\n backend "s3" {\n dynamodb_table = "tf-lock"\n }\n}

DynamoDB state lock against concurrency

data "terraform_remote_state" "db" {\n  backend = "s3"\n  config = {\n    bucket = "shared-state"\n    key = "db/terraform.tfstate"\n  }\n}

Read remote state across configurations

data.terraform_remote_state.db.outputs.db_endpoint

Reference a remote state output

terraform init -reconfigure

Reconfigure the backend (migrate state)

terraform init -migrate-state

Migrate the state file to a new backend

Advanced Features 9

terraform workspace new staging

Create a new workspace

terraform workspace list

List all workspaces

terraform workspace select staging

Switch to a workspace

resource "aws_instance" "web" {\n for_each = var.subnets\n}

for_each creates resources from a set

resource "aws_instance" "web" {\n count = var.instance_count\n}

count creates resources by number

depends_on = [aws_s3_bucket.data]

Explicit dependency to fix creation order

lifecycle {\n create_before_destroy = true\n}

Lifecycle: create before destroy

lifecycle {\n prevent_destroy = true\n}

Lifecycle: prevent accidental destroy

lifecycle {\n ignore_changes = [tags]\n}

Lifecycle: ignore changes to specific attributes

Debugging 8

terraform console

Interactive console to test expressions

terraform graph | dot -Tpng > graph.png

Generate a resource dependency graph

terraform show

Readable dump of the current state

terraform show -json

JSON state output for jq

TF_LOG=DEBUG terraform apply

Enable DEBUG-level logging

TF_LOG=TRACE terraform plan

TRACE-level logging, most verbose

TF_LOG_PATH=./tf.log terraform apply

Write logs to a file

export TF_LOG=WARN

Set log level (TRACE/DEBUG/INFO/WARN/ERROR)

Tips

terraform plan never modifies resources — use it freely
Keep secrets in variables; never hardcode them in .tf files
Use terraform fmt to standardize formatting — essential for teams
The state file holds sensitive data; never commit it to Git
Use a remote backend (e.g. S3 + DynamoDB) for collaboration and state locking

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

GitLab CI Docs

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.