Terraform Cheat Sheet

Initializes a working directory: downloads providers and modules, sets up the backend. Always the first command in a new or freshly-cloned Terraform directory.

Shows exactly what Terraform would change — create, update, destroy — without actually doing any of it. Always read a plan before applying it.

Applies the changes described in a plan, prompting for confirmation first unless -auto-approve is passed.

Destroys every resource Terraform is currently managing in state.

Checks configuration files for syntax errors and internal consistency, without contacting any provider or touching real infrastructure.

Rewrites configuration files into Terraform's canonical formatting style — the HCL equivalent of a code formatter.

Configures a provider — the plugin Terraform uses to talk to a specific platform (AWS, Google Cloud, Kubernetes, and hundreds more).

Declares a piece of infrastructure Terraform should create and manage — the type (aws_instance) comes from the provider, the name (web) is your own label.

References a declared resource elsewhere in your configuration — in an output, another resource's argument, or an expression.

References one specific instance out of a resource created with for_each, by its key.

Declares an input variable, with an optional type constraint and default value.

References a declared variable's value anywhere in the configuration.

Exposes a value after apply — printed to the terminal, and available to any module that calls this configuration as a child module.

A file providing values for declared variables, loaded automatically if it's named exactly terraform.tfvars (or matches *.auto.tfvars).

Overrides a single variable's value from the command line, taking priority over any default or tfvars file.

Loads variable values from a specific file — the usual way to point the same configuration at a different environment's values.

Lists every resource currently tracked in state.

Shows the full recorded attributes of one specific resource in state.

Renames a resource in state without destroying and recreating the real infrastructure — the fix when you rename a resource block in code and don't want Terraform to treat it as brand new.

Removes a resource from state without destroying the real infrastructure — Terraform simply stops tracking it.

Configures a remote backend — where state is actually stored, instead of a local file on one person's machine.

Calls a reusable module, either from a local path (shown here) or a registry source like terraform-aws-modules/vpc/aws, passing in its input variables.

References one of a called module's declared outputs, the same way you'd reference a resource's attribute.

Downloads or updates modules referenced by the configuration, without doing a full init.

Reads information about an existing resource Terraform isn't managing — the read-only counterpart to a resource block.

References an attribute from a declared data source.

Splices a value into the middle of a literal string using interpolation syntax.

A for expression — transforms a list or map into another list or map, the closest thing HCL has to a loop.

A conditional expression — evaluates to the first value if the condition is true, the second if it's false.

Creates a new workspace — a distinct state, kept separate from other workspaces, under the same configuration and backend.

Switches to a different existing workspace.

Lists every workspace and marks the currently active one.

A built-in reference to the current workspace's name, usable inside your configuration — for example, to vary an instance size or a resource's tags per environment.

Creates the replacement resource before destroying the original, instead of the default destroy-then-create order — avoids a window with no resource at all for anything that can't tolerate downtime.

Makes Terraform refuse to destroy this specific resource, causing plan or apply to error out instead — a guardrail for anything genuinely irreplaceable.

Tells Terraform to stop treating drift on specific arguments as something to fix — useful when another system (like autoscaling) legitimately manages that field after creation.

Forces an explicit dependency between resources that Terraform can't infer automatically from a direct reference — used sparingly, when a real ordering requirement isn't otherwise visible in the configuration.

Runs an arbitrary script when a resource is created or destroyed — deliberately the last option on this page, not a first choice.

Brings a resource that already exists in the real world — created manually, or by another tool — under Terraform's management, without recreating it.

Declares that a resource was renamed or moved in configuration, so Terraform updates state to match instead of destroying the old address and creating the new one — the modern, version-controlled alternative to running terraform state mv by hand.