Terraform Cheatsheet

Terraform is an Infrastructure as Code (IaC) tool by HashiCorp that lets you define both cloud and on-prem resources in human-readable configuration files.

Installation

# Debian / Ubuntu (official HashiCorp repository)
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform
 
# RHEL / CentOS / Fedora
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo dnf install terraform
 
# macOS
brew install terraform
 
# Verify installation
terraform version

Basic Workflow

The standard Terraform workflow:

terraform init                         # Initialize working directory (downloads providers/modules)
terraform plan                         # Preview changes (dry run, no modifications)
terraform apply                        # Apply changes to create/update infrastructure
terraform destroy                      # Destroy all managed infrastructure

Formatting and Validation

terraform fmt                          # Auto-format .tf files to canonical style
terraform fmt -check                   # Check if files are formatted (useful in CI/CD)
terraform fmt -recursive               # Format all files in subdirectories too
terraform validate                     # Check syntax and internal consistency of configuration

State Management

Terraform tracks real-world resources in a state file (terraform.tfstate).

terraform state list                   # List all resources in the state
terraform state show <resource>        # Show details of a specific resource
terraform state rm <resource>          # Remove a resource from state (does NOT destroy the real resource)
terraform state mv <old> <new>         # Rename or move a resource in state
terraform state pull                   # Download current remote state to stdout
terraform state push                   # Upload local state to remote backend
 
# Import an existing real-world resource into Terraform management
terraform import aws_instance.web i-1234567890abcdef0

Outputs

terraform output                       # Show all output values
terraform output instance_ip           # Show a specific output value
terraform output -json                 # Show outputs in JSON format

Workspaces

Manage multiple environments (dev, staging, prod) from the same configuration.

terraform workspace list               # List all workspaces
terraform workspace new dev            # Create a new workspace named 'dev'
terraform workspace select prod        # Switch to the 'prod' workspace
terraform workspace show               # Show current workspace name
terraform workspace delete dev         # Delete a workspace

Variables and Auto-Approve

# Apply without interactive confirmation (use with caution)
terraform apply -auto-approve
 
# Destroy without interactive confirmation
terraform destroy -auto-approve
 
# Pass a variable via command line
terraform apply -var="instance_type=t2.large"
 
# Use a specific variable file
terraform apply -var-file="production.tfvars"
 
# Override a variable and auto-approve
terraform apply -var="region=eu-west-1" -auto-approve

Targeting and Tainting

# Apply only a specific resource (skip everything else)
terraform apply -target=aws_instance.web
 
# Mark a resource for forced recreation on next apply
terraform taint aws_instance.web
 
# Remove the taint from a resource
terraform untaint aws_instance.web

Provider Configuration Example

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
provider "aws" {
  region = "us-east-1"
}

Debugging

# Enable detailed Terraform logging
export TF_LOG=DEBUG                    # Levels: TRACE, DEBUG, INFO, WARN, ERROR
export TF_LOG_PATH=terraform.log       # Write logs to a file
 
# Disable logging
unset TF_LOG

Cheatsheets