Terraform — cheat sheet

A one-page lookup for the commands and flags used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Setup & static checks

Task	Command
Download providers/modules, configure the backend	terraform init
Re-resolve provider/module versions	terraform init -upgrade
Re-read the backend block (e.g. after changing it)	terraform init -reconfigure
Canonicalise formatting	terraform fmt -recursive
Formatting check only, no rewrite (CI gate)	terraform fmt -check
Syntax/type/reference check — no state, no credentials	terraform validate

Everyday workflow

Task	Command
Compute a plan, save it to a file	terraform plan -out plan.bin
Apply exactly the saved plan file	terraform apply plan.bin
Apply with no saved file (interactive; prompts to confirm)	terraform apply
Show a saved plan, human-readable	terraform show plan.bin
Show a saved plan as JSON (for jq/policy tools)	terraform show -json plan.bin \| jq .
Print all outputs	terraform output
Print one output as raw text (no quotes)	terraform output -raw <name>
Print outputs as JSON	terraform output -json

Reading a plan — the symbol legend

Symbol	Action	Trigger
+	Create	In config, not yet in state.
~	Update in place	An argument changed that the provider can update without recreating.
-/+	Destroy and recreate	An argument changed that's ForceNew on the provider — no in-place API call exists.
-	Destroy	In state, no longer in config.

Targeting, replacing, destroying

Task	Command
Restrict plan/apply to one address + its dependencies	terraform plan -target=<address> -out plan.bin
Force destroy-and-recreate of one address next apply	terraform apply -replace=<address>
Plan a full teardown	terraform plan -destroy -out destroy.bin
Apply a teardown plan	terraform apply destroy.bin
Destroy one resource (and its dependents) directly	terraform destroy -target=<address>

State operations

Task	Command
List every resource in state	terraform state list
Show one resource's attributes	terraform state show <address>
Rename an address in state without recreating	terraform state mv <old> <new>
Forget a resource (does not delete it in the cloud)	terraform state rm <address>
Download a read-only copy of state	terraform state pull > state.local.json
Reconcile state with reality, propose no other change	terraform plan -refresh-only
Same, non-zero exit if drift found (CI)	terraform plan -refresh-only -detailed-exitcode

Import & refactor blocks (in config)

Block	Purpose
import { to = ..., id = "..." }	Bring an existing resource under management (1.5+) without changing it.
moved { from = ..., to = ... }	Record an address rename so Terraform updates state instead of destroy/recreate (1.1+).

Iteration primitives

Primitive	Use when	Removing one element
count = N	Disposable, identity-less copies.	Shifts every index above it — those get destroyed/recreated too.
for_each = {...} / for_each = toset([...])	Instances have a natural identity (name, AZ).	Only that keyed instance is touched.
dynamic "block" {...}	A repeatable nested block inside one resource.	N/A — not a resource, just repeated config.

lifecycle meta-arguments

Argument	Effect
prevent_destroy = true	Any plan that would destroy this resource errors out.
create_before_destroy = true	On a forced replace, create the new resource before destroying the old one.
ignore_changes = [attr, ...]	Stop diffing the listed attributes.
replace_triggered_by = [...]	Force a replace when a referenced attribute changes.

Modules — sourcing

Source form	Example
Local path	source = "./modules/network"
Registry	source = "terraform-aws-modules/vpc/aws" + version = "5.1.0"
Git (always pin a tag, never a branch)	source = "git::https://github.com/org/repo.git//path?ref=v1.4.0"

Workspaces

Task	Command
List workspaces	terraform workspace list
Create one	terraform workspace new <name>
Switch to one	terraform workspace select <name>
Delete one	terraform workspace delete <name>
Read the active workspace inside config	terraform.workspace

Console & debugging

Task	Command
Evaluate expressions against real state interactively	terraform console
Verbose provider/core logging	TF_LOG=DEBUG terraform plan
Log to a file at trace level	TF_LOG_PATH=tf.log TF_LOG=TRACE terraform apply

CI shape (see also the CI page)

Stage	Command
Style gate, no state/credentials	terraform fmt -check
Syntax/type gate, no state/credentials	terraform validate
Save the reviewed plan on the PR run	terraform plan -out=tfplan
Apply the exact reviewed file on merge	terraform apply tfplan
Nightly drift check	terraform plan -refresh-only -detailed-exitcode

How this connects

The state page covers import/moved/locking, the providers & lifecycle page covers count vs for_each and the ForceNew distinction, the modules page covers sourcing and version pinning, and the CI page covers plan/apply symmetry and promotion.