← all cheat sheets

OPERATOR REFERENCE · TERRAFORM

Terraform Field Reference
HCL, State & Workflow

init → plan → apply → state → modules → workspaces — one page, every day

HCL · .tf

plan (diff) → apply

PROVIDER API → STATE FILE

01 Setup & Init

◎

Init

terraform init terraform init -upgrade

⚙

Provider Block

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
provider "aws" { region = "us-east-1" }

✓

Version / Validate

terraform version terraform validate terraform fmt

02 Core Workflow

Plan

terraform plan terraform plan -out=tfplan

Always review a plan before applying — it's the diff between desired and current state.

▶

Apply

terraform apply terraform apply tfplan terraform apply -auto-approve

⚠ -auto-approve skips the confirmation prompt — CI-only, not interactive use

Destroy

terraform destroy terraform destroy -target=aws_instance.web

⚠ tears down every resource Terraform is tracking, not just the last change

03 Resource & Variable Syntax

▦

Resource Block

resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = "t3.micro"
  tags = { Name = "web-01" }
}

Variables & Outputs

variable "ami_id" {
  type    = string
  default = "ami-0123456789"
}

output "public_ip" {
  value = aws_instance.web.public_ip
}

◈

locals & Interpolation

locals {
  env = "prod"
}
name = "${local.env}-web-01"

📄

.tfvars

terraform apply -var-file="prod.tfvars" ami_id = "ami-0abcdef1234"

04 State Management

▤

Inspect State

terraform state list terraform state show aws_instance.web

⇄

Move / Remove

terraform state mv aws_instance.web aws_instance.web01 terraform state rm aws_instance.old

state rm stops tracking a resource without destroying it in the real world.

☁

Remote Backend

terraform {
  backend "s3" {
    bucket = "tf-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
    dynamodb_table = "tf-locks"
  }
}

The DynamoDB table is what provides state locking for concurrent applies.

↓

Import & Pull

terraform import aws_instance.web i-0abc123 terraform state pull > state.json

🔒

Locking

terraform force-unlock LOCK_ID

⚠ only force-unlock if you're certain no other apply is actually in progress

↻

Refresh

terraform apply -refresh-only

Reconciles state with real infrastructure without changing anything.

05 Modules & Workspaces

📦

Modules

module "vpc" {
  source = "./modules/vpc"
  cidr   = "10.0.0.0/16"
}

terraform get -update

▣

Workspaces

terraform workspace new staging terraform workspace select prod terraform workspace list

Each workspace gets its own state file under the same backend — a lightweight way to separate environments.

06 Common Errors & Quick Reference

Symptom	Fix
Error acquiring the state lock	wait for the other apply, or force-unlock if it's stale
Resource already exists (outside TF)	terraform import to bring it under management
Plan shows unexpected drift	someone changed infra manually — reconcile or ignore_changes
Provider version conflict	pin version in required_providers, re-run init -upgrade
Destroy deletes more than expected	check for cascading dependencies, use -target sparingly
Circular dependency error	break the cycle with a data source or restructure resources

Command	Purpose
terraform plan -out=tfplan	safe saves an exact plan to apply later
terraform apply -auto-approve	caution no confirmation — CI pipelines only
terraform destroy	destructive tears down all tracked resources
terraform force-unlock	caution only if lock is confirmed stale
terraform graph	outputs the dependency graph (pipe to Graphviz)
terraform console	interactive REPL for testing expressions