$ man terraform | less

Cheat sheet.
The commands you need every day.

This isn't a reference of resource fields, it's a map of the CLI commands. Each card: the command, what it does, a link to KB. Grouped by what you usually do in sequence.

It prints. Ctrl/Cmd + P gives a single-page layout with no navigation.

init · plan · apply

The main loop. Without these three there's no life in Terraform.

terraform init
Download providers and modules, create .terraform.lock.hcl.
kb · tf-init
terraform init -upgrade
Re-read modules and providers from scratch; needed when version/source changes.
kb · tf-init-modules
terraform init -backend-config=...
Feed backend parameters without editing HCL (CI, multi-env).
kb · tf-remote-backend-s3
terraform plan
The diff between HCL and state. Changes nothing. Run it as often as you like.
kb · tf-plan
terraform plan -out=plan.tfplan
Save the plan as an artifact; apply from the file guarantees the same outcome.
kb · tf-plan-apply-ci
terraform plan -detailed-exitcode
Exit 0 means no changes, 2 means changes, 1 means error. For drift detection and CI.
kb · tf-drift-detection
terraform apply -auto-approve
Apply the plan without confirmation. In CI, always from plan.tfplan.
kb · tf-apply
terraform apply plan.tfplan
Apply a saved plan without re-planning, an exact copy.
kb · tf-plan-apply-ci
terraform destroy
Tear down everything in state. Almost never in production; constantly while learning.
kb · tf-destroy

state · refactor

State is Terraform's memory. Move it carefully, keep a backup.

terraform show -json | jq
Print state as JSON. The basic tool for verify and debugging.
kb · tf-state
terraform state list
The addresses of every resource in state. A module.X prefix means a module resource.
kb · tf-state
terraform state show ADDR
The full contents of one resource in state, including sensitive fields.
kb · tf-state-manipulation
terraform state mv A B
Rename in state without destroy. Alternative: the moved block.
kb · tf-moved-block
terraform state rm ADDR
Remove from state without touching the cloud. Alternative: the removed block.
kb · tf-removed-block
terraform import ADDR ID
Pull an existing cloud resource into state.
kb · tf-state-import
import { to = ADDR id = "..." }
Declarative import (TF 1.5+). The plan shows it before apply, unlike the CLI.
kb · tf-state-import
moved { from = A to = B }
Rename without destroy when you refactor code.
kb · tf-moved-block
removed { from = A lifecycle { destroy = false } }
TF 1.7+: drop a resource from state, keep it in the cloud.
kb · tf-removed-block

workflow · refactor

HCL hygiene. The good commands have no consequences, the bad ones do.

terraform fmt -recursive
Canonical formatting. -check for CI.
kb · tf-fmt
terraform validate
Syntax and type checks with no cloud calls.
kb · tf-validate
terraform console
A REPL for expressions, type(), and quick state reads.
kb · tf-console
terraform graph | dot -Tsvg > graph.svg
The dependency graph. A cycle? -draw-cycles.
kb · tf-graph
terraform apply -replace=ADDR
Force-recreate a resource. It cascades to dependencies.
kb · tf-replace-target
terraform apply -target=ADDR
The emergency 'roll out only this'. Not a normal workflow.
kb · tf-replace-target
terraform output -raw NAME
Read an output without quotes. For scripts and pipes.
kb · tf-output
terraform workspace select dev
Switch to a named workspace. Not for multi-env in production.
kb · tf-workspace

debugging

When the plan is unclear or apply fails: the order of moves.

TF_LOG=DEBUG terraform plan
Levels: TRACE, DEBUG, INFO, WARN, ERROR. TRACE shows the provider's HTTP calls.
kb · tf-log-debug
TF_LOG_PATH=tf.log TF_LOG=DEBUG terraform apply
Logs to a file, not stderr. For incident analysis and tickets.
kb · tf-log-debug
terraform plan -no-color | grep -E "^( [+~-]|Plan:)"
Filter the diff: only change lines and the summary.
kb · tf-plan-diff
terraform show plan.tfplan
Read a binary plan as a human. -json suits machines.
kb · tf-plan-diff
terraform refresh
Refresh state from the cloud without changing HCL. Useful on drift.
kb · tf-drift-detection
terraform force-unlock LOCK_ID
Release a stuck state lock. Only if you're sure no one is working.
kb · tf-common-errors
terraform graph -draw-cycles | dot -Tsvg
Highlight cycles in the dependency graph. The Cycle Error comes from here.
kb · tf-common-errors

testing

Native tests, mock providers, terratest. What and when.

terraform test
Run .tftest.hcl from the config root and from tests/ (the default test directory). TF 1.6+.
kb · tf-test-framework
terraform test -filter=tests/plan.tftest.hcl
One file only. Handy when debugging an assert.
kb · tf-test-framework
mock_provider "aws" { ... }
No cloud. Any resources become fakes, and asserts still work.
kb · tf-test-mocks
go test -timeout 30m ./...
Terratest. Brings up real infra, runs checks, tears it down.
kb · terratest-basics
terraform-compliance -p plan.json -f features/
BDD policy through Gherkin. An alternative to OPA for non-technical reviewers.
kb · terraform-compliance

security · linters

fmt → validate → tflint → checkov → trivy → OPA. In order of strictness.

tflint --recursive
Style and logic rules over HCL. The AWS ruleset ships separately.
kb · tf-fmt-validate-ci
checkov -d .
A static security scanner for HCL and plan.json. Suppression goes in comments.
kb · tf-checkov
trivy config .
A tfsec replacement; on HCL and plan.json. CIS checks in one tool.
kb · tf-trivy-tfsec
conftest test --policy policies/ plan.json
OPA/Rego: deny rules over plan.json. For the policy gate in CI.
kb · tf-policy-as-code
pre-commit install
fmt/validate/tflint/checkov hooks on git commit. No more 'forgot to run it'.
kb · tf-fmt-validate-ci
terraform output -json | jq '. | walk(...)'
Sensitive is redacted in output but visible in state. Don't put secrets here.
kb · tf-sensitive

advanced

Terragrunt, CDKTF, Infracost, OpenTofu. When the basics aren't enough.

terragrunt run-all plan
Plan across all stack modules. dependency blocks sort out the order.
kb · tf-terragrunt
cdktf init --template typescript
A starter CDKTF project. Then cdktf synth → plain HCL.
kb · tf-cdktf
infracost breakdown --path .
Cost estimate for the plan. In CI it diffs PR against main.
kb · tf-cost-infracost
tofu init && tofu apply
OpenTofu. The CLI is identical, state is compatible. Same provider.
kb · tf-opentofu-parity
rover -tfPath terraform -workingDir .
A web visualizer for the graph and plan. Handy for review presentations.
kb · tf-rover-visualization

A cheat sheet is an anchor, not a textbook. To get the commands into your head, run them by hand. The full path: /intro. Straight to practice: /lessons. The running project: /capstone.

$ man terraform | less

Cheat sheet.
The commands you need every day.

This isn't a reference of resource fields, it's a map of the CLI commands. Each card: the command, what it does, a link to KB. Grouped by what you usually do in sequence.

It prints. Ctrl/Cmd + P gives a single-page layout with no navigation.

init · plan · apply

The main loop. Without these three there's no life in Terraform.

terraform init
Download providers and modules, create .terraform.lock.hcl.
kb · tf-init
terraform init -upgrade
Re-read modules and providers from scratch; needed when version/source changes.
kb · tf-init-modules
terraform init -backend-config=...
Feed backend parameters without editing HCL (CI, multi-env).
kb · tf-remote-backend-s3
terraform plan
The diff between HCL and state. Changes nothing. Run it as often as you like.
kb · tf-plan
terraform plan -out=plan.tfplan
Save the plan as an artifact; apply from the file guarantees the same outcome.
kb · tf-plan-apply-ci
terraform plan -detailed-exitcode
Exit 0 means no changes, 2 means changes, 1 means error. For drift detection and CI.
kb · tf-drift-detection
terraform apply -auto-approve
Apply the plan without confirmation. In CI, always from plan.tfplan.
kb · tf-apply
terraform apply plan.tfplan
Apply a saved plan without re-planning, an exact copy.
kb · tf-plan-apply-ci
terraform destroy
Tear down everything in state. Almost never in production; constantly while learning.
kb · tf-destroy

state · refactor

State is Terraform's memory. Move it carefully, keep a backup.

terraform show -json | jq
Print state as JSON. The basic tool for verify and debugging.
kb · tf-state
terraform state list
The addresses of every resource in state. A module.X prefix means a module resource.
kb · tf-state
terraform state show ADDR
The full contents of one resource in state, including sensitive fields.
kb · tf-state-manipulation
terraform state mv A B
Rename in state without destroy. Alternative: the moved block.
kb · tf-moved-block
terraform state rm ADDR
Remove from state without touching the cloud. Alternative: the removed block.
kb · tf-removed-block
terraform import ADDR ID
Pull an existing cloud resource into state.
kb · tf-state-import
import { to = ADDR id = "..." }
Declarative import (TF 1.5+). The plan shows it before apply, unlike the CLI.
kb · tf-state-import
moved { from = A to = B }
Rename without destroy when you refactor code.
kb · tf-moved-block
removed { from = A lifecycle { destroy = false } }
TF 1.7+: drop a resource from state, keep it in the cloud.
kb · tf-removed-block

workflow · refactor

HCL hygiene. The good commands have no consequences, the bad ones do.

terraform fmt -recursive
Canonical formatting. -check for CI.
kb · tf-fmt
terraform validate
Syntax and type checks with no cloud calls.
kb · tf-validate
terraform console
A REPL for expressions, type(), and quick state reads.
kb · tf-console
terraform graph | dot -Tsvg > graph.svg
The dependency graph. A cycle? -draw-cycles.
kb · tf-graph
terraform apply -replace=ADDR
Force-recreate a resource. It cascades to dependencies.
kb · tf-replace-target
terraform apply -target=ADDR
The emergency 'roll out only this'. Not a normal workflow.
kb · tf-replace-target
terraform output -raw NAME
Read an output without quotes. For scripts and pipes.
kb · tf-output
terraform workspace select dev
Switch to a named workspace. Not for multi-env in production.
kb · tf-workspace

debugging

When the plan is unclear or apply fails: the order of moves.

TF_LOG=DEBUG terraform plan
Levels: TRACE, DEBUG, INFO, WARN, ERROR. TRACE shows the provider's HTTP calls.
kb · tf-log-debug
TF_LOG_PATH=tf.log TF_LOG=DEBUG terraform apply
Logs to a file, not stderr. For incident analysis and tickets.
kb · tf-log-debug
terraform plan -no-color | grep -E "^( [+~-]|Plan:)"
Filter the diff: only change lines and the summary.
kb · tf-plan-diff
terraform show plan.tfplan
Read a binary plan as a human. -json suits machines.
kb · tf-plan-diff
terraform refresh
Refresh state from the cloud without changing HCL. Useful on drift.
kb · tf-drift-detection
terraform force-unlock LOCK_ID
Release a stuck state lock. Only if you're sure no one is working.
kb · tf-common-errors
terraform graph -draw-cycles | dot -Tsvg
Highlight cycles in the dependency graph. The Cycle Error comes from here.
kb · tf-common-errors

testing

Native tests, mock providers, terratest. What and when.

terraform test
Run .tftest.hcl from the config root and from tests/ (the default test directory). TF 1.6+.
kb · tf-test-framework
terraform test -filter=tests/plan.tftest.hcl
One file only. Handy when debugging an assert.
kb · tf-test-framework
mock_provider "aws" { ... }
No cloud. Any resources become fakes, and asserts still work.
kb · tf-test-mocks
go test -timeout 30m ./...
Terratest. Brings up real infra, runs checks, tears it down.
kb · terratest-basics
terraform-compliance -p plan.json -f features/
BDD policy through Gherkin. An alternative to OPA for non-technical reviewers.
kb · terraform-compliance

security · linters

fmt → validate → tflint → checkov → trivy → OPA. In order of strictness.

tflint --recursive
Style and logic rules over HCL. The AWS ruleset ships separately.
kb · tf-fmt-validate-ci
checkov -d .
A static security scanner for HCL and plan.json. Suppression goes in comments.
kb · tf-checkov
trivy config .
A tfsec replacement; on HCL and plan.json. CIS checks in one tool.
kb · tf-trivy-tfsec
conftest test --policy policies/ plan.json
OPA/Rego: deny rules over plan.json. For the policy gate in CI.
kb · tf-policy-as-code
pre-commit install
fmt/validate/tflint/checkov hooks on git commit. No more 'forgot to run it'.
kb · tf-fmt-validate-ci
terraform output -json | jq '. | walk(...)'
Sensitive is redacted in output but visible in state. Don't put secrets here.
kb · tf-sensitive

advanced

Terragrunt, CDKTF, Infracost, OpenTofu. When the basics aren't enough.

terragrunt run-all plan
Plan across all stack modules. dependency blocks sort out the order.
kb · tf-terragrunt
cdktf init --template typescript
A starter CDKTF project. Then cdktf synth → plain HCL.
kb · tf-cdktf
infracost breakdown --path .
Cost estimate for the plan. In CI it diffs PR against main.
kb · tf-cost-infracost
tofu init && tofu apply
OpenTofu. The CLI is identical, state is compatible. Same provider.
kb · tf-opentofu-parity
rover -tfPath terraform -workingDir .
A web visualizer for the graph and plan. Handy for review presentations.
kb · tf-rover-visualization

A cheat sheet is an anchor, not a textbook. To get the commands into your head, run them by hand. The full path: /intro. Straight to practice: /lessons. The running project: /capstone.

Cheat sheet.
The commands you need every day.

init · plan · apply

state · refactor

workflow · refactor

debugging

testing

security · linters

advanced

Next

Cheat sheet.
The commands you need every day.

init · plan · apply

state · refactor

workflow · refactor

debugging

testing

security · linters

advanced

Next

Cheat sheet.The commands you need every day.

init · plan · apply

state · refactor

workflow · refactor

debugging

testing

security · linters

advanced

Next

Cheat sheet.The commands you need every day.

init · plan · apply

state · refactor

workflow · refactor

debugging

testing

security · linters

advanced

Next

Cheat sheet.
The commands you need every day.

Cheat sheet.
The commands you need every day.