30+ Commands

Terraform & OpenTofu CLI Commands Cheat Sheet

Production Terraform & OpenTofu CLI reference matrix covering init, plan, apply, state manipulation, targeting, workspaces, and debugging with 1-click copy.

Core Workflow (8 commands)

Core Workflow

terraform init

Initialize working directory, download provider plugins and remote modules defined in configuration.

PRO TIP Must be run whenever you add new providers, change backend config, or add modules.

Core Workflow

terraform init -upgrade

Re-evaluates provider version constraints and upgrades installed plugins to newest permitted versions.

PRO TIP Use to update AWS, Azure, or Cloudflare provider versions safely.

Core Workflow

terraform validate

Verifies configuration syntax, argument types, and internal consistency without accessing cloud APIs.

PRO TIP Fast, offline check to include in git pre-commit hooks and CI pipelines.

Core Workflow

terraform fmt -recursive

Automatically rewrites all Terraform configuration files in canonical style and indentation.

PRO TIP Enforces clean consistent HCL formatting across entire repository.

Core Workflow

terraform plan -out=tfplan.binary

Creates speculative execution plan against real infrastructure state and saves to reproducible binary file.

PRO TIP Always save plans in CI/CD pipelines to guarantee the applied changes match review.

Core Workflow

terraform apply tfplan.binary

Executes exact previously saved execution plan file with zero prompts, preventing drift race conditions.

PRO TIP Guarantees no unreviewed changes occur between planning and application.

Core Workflow

terraform apply -auto-approve

Executes changes immediately without interactive confirmation prompt. Ideal for automated CI/CD pipelines.

PRO TIP Use with caution on production; pair with targeted branch protection rules.

Core Workflow

terraform destroy -auto-approve

Destroys all managed remote infrastructure resources described in the working directory state.

PRO TIP Irreversible action! Ensure state backup exists before executing on live clusters.

State Management (6 commands)

State Management

terraform state list

Lists all resource addresses currently recorded in the Terraform remote state file.

PRO TIP Quickly inspect which VPCs, instances, and DNS records Terraform is managing.

State Management

terraform state show aws_instance.web

Displays comprehensive attribute breakdown, IPs, and metadata for a specific resource address.

PRO TIP Useful for debugging actual computed cloud attributes without opening AWS console.

State Management

terraform state rm aws_s3_bucket.legacy

Removes resource from Terraform state without destroying the actual cloud resource.

PRO TIP Deprovisions tracking cleanly when adopting existing resources or migrating modules.

State Management

terraform state mv module.vpc.aws_vpc.main module.network.aws_vpc.main

Renames or moves resource within state file to preserve existing cloud infrastructure without recreating.

PRO TIP Essential when refactoring configuration files into modular submodules.

State Management

terraform state pull > state_backup.json

Downloads and displays state from remote backend (S3/GCS/Consul) to stdout.

PRO TIP Use for manual emergency backups prior to risky migrations or manual edits.

State Management

terraform force-unlock <LOCK_ID>

Manually unlocks remote state backend after a crashed or interrupted apply execution.

PRO TIP Confirm no other teammate or pipeline is running before forcing lock release.

Targeting & Workspaces (6 commands)

Targeting & Workspaces

terraform apply -target=module.vpc.aws_subnet.public

Applies changes exclusively to specified resource and direct dependencies, ignoring remaining config.

PRO TIP Useful for emergency hotfixes or bootstrapping foundational networking resources.

Targeting & Workspaces

terraform apply -var="environment=production" -var="instance_count=4"

Passes input variables directly from command line arguments, overriding default variable files.

PRO TIP Use TF_VAR_name environment variables for sensitive secrets to avoid shell history logging.

Targeting & Workspaces

terraform apply -var-file="production.tfvars"

Loads variable values from dedicated environment definition file (e.g., staging.tfvars or prod.tfvars).

PRO TIP Standard pattern for maintaining distinct multi-environment configurations.

Targeting & Workspaces

terraform output -json

Extracts and formats all defined output values into machine-readable JSON for downstream automation.

PRO TIP Pipe into jq or Ansible to pass dynamic load balancer IPs to provisioning scripts.

Targeting & Workspaces

terraform workspace new production

Creates and switches to a new isolated state workspace with independent infrastructure resources.

PRO TIP Allows maintaining dev, staging, and prod state files from a single codebase.

Targeting & Workspaces

terraform workspace select staging

Switches current active workspace to existing staging environment state file.

PRO TIP Run terraform workspace list to verify which environment is currently active.

Import & Debugging (4 commands)

Import & Debugging

terraform import aws_s3_bucket.assets my-existing-bucket-name

Imports pre-existing real-world cloud resource into Terraform state tracking without downtime.

PRO TIP Write empty resource block first, run import, then populate attributes from state.

Import & Debugging

export TF_LOG=DEBUG && terraform plan

Enables verbose low-level HTTP and RPC debugging logs to identify authentication or timeout errors.

PRO TIP Use export TF_LOG_PATH=terraform.log to stream debug traces directly into a log file.

Import & Debugging

terraform graph | dot -Tsvg > graph.svg

Generates visual directed acyclic graph (DAG) of all module and resource execution dependencies.

PRO TIP Requires Graphviz dot installed on your local workstation.

Import & Debugging

terraform console

Interactive evaluation shell for testing Terraform expressions, HCL functions, and interpolation.

PRO TIP Test complex cidrsubnet(), merge(), or regex() logic interactively.