glunty

Terraform Cheat Sheet

A searchable reference of Terraform CLI commands and HCL blocks and what each one does.

Command or block What it does
terraform init Initialize a working directory: download providers and modules and set up the backend.
terraform plan Preview the actions Terraform will take to reach the desired state without changing anything.
terraform plan -out=plan.tfplan Save the planned changes to a file so a later apply runs exactly that plan.
terraform apply Show the plan and, after you confirm, create or update infrastructure to match the config.
terraform apply -auto-approve Apply changes without the interactive yes prompt; common in automation but risky.
terraform apply plan.tfplan Apply a previously saved plan file with no further prompt.
terraform destroy Remove all remote objects that Terraform manages for this configuration.
terraform fmt Rewrite configuration files to the canonical Terraform style and formatting.
terraform validate Check the configuration for syntax errors and internal consistency.
terraform output Print the output values recorded in the current state.
terraform show Display the current state or a saved plan in readable form.
terraform refresh Reconcile state with real infrastructure; superseded by apply -refresh-only.
terraform version Print the Terraform version and the versions of installed providers.
terraform state list List the resource addresses tracked in the current state.
terraform state show <address> Show the attributes of one resource recorded in the state.
terraform state mv <src> <dst> Rename or move a resource in state without destroying and recreating it.
terraform state rm <address> Stop managing a resource by removing it from state; the real object is left in place.
terraform import <address> <id> Bring an existing real resource under Terraform management by writing it into state.
terraform taint <address> Mark a resource for recreation on the next apply; deprecated in favor of -replace.
terraform apply -replace="<address>" Force one resource to be destroyed and recreated; the modern replacement for taint.
terraform force-unlock <lock-id> Manually release a stuck state lock left behind by a failed run.
terraform state pull Download and print the raw remote state as JSON.
backend "s3" { ... } Configure remote state storage and locking in a shared backend such as S3.
resource "aws_instance" "web" { ... } Declare a piece of infrastructure for Terraform to create and manage.
data "aws_ami" "ubuntu" { ... } Fetch read-only information from a provider to use elsewhere in the config.
provider "aws" { region = "us-east-1" } Configure a provider plugin, for example its region or credentials.
variable "name" { type = string } Declare an input variable that the module accepts.
output "url" { value = aws_instance.web.public_ip } Expose a value from the module to the CLI or a parent module.
module "vpc" { source = "./modules/vpc" } Call a reusable child module and pass it input variables.
terraform { required_version = ">= 1.5" } Set core settings such as the required version, providers, and backend.
locals { name = "web" } Define named local values to reuse expressions within a module.
variable "region" { type = string default = "us-east-1" } Declare a typed input variable with a default used when no value is supplied.
var.region Reference the value of an input variable elsewhere in the configuration.
terraform.tfvars Auto-loaded file that assigns values to input variables.
TF_VAR_region=us-east-1 Set a variable through an environment variable named TF_VAR_ plus the variable name.
terraform apply -var="region=us-east-1" Set a single variable value directly on the command line.
variable "password" { sensitive = true } Mark a variable as sensitive so its value is hidden in plan and apply output.
"${var.name}-web" Insert an expression into a string using a dollar sign and braces.
count = 3 Create multiple copies of a resource by number; each is addressed by count.index.
for_each = toset(["a", "b"]) Create one instance per item in a map or set; use each.key and each.value inside.
condition ? true_val : false_val Pick between two values with a ternary expression using a question mark and colon.
[for s in var.list : upper(s)] Build a new list or map by transforming another collection.
depends_on = [aws_iam_role.example] Declare an explicit dependency when Terraform cannot infer the order.
length(var.list) Call a built-in function; others include join, lookup, merge, and coalesce.
var.instances[*].id Extract one attribute from every element of a list with the splat operator.
dynamic "ingress" { for_each = var.rules } Generate repeated nested blocks programmatically inside a resource.
terraform workspace new <name> Create a new named workspace with its own separate state.
terraform workspace select <name> Switch to an existing workspace.
terraform workspace list List all workspaces and mark the current one.
terraform get Download and update the modules referenced by the configuration.
terraform providers Show the providers the configuration requires and where they are used.

Runs entirely in your browser. Nothing you type is sent anywhere; open DevTools and watch the Network tab to verify zero requests.

What this tool does

This is a searchable quick reference for Terraform, covering both the CLI commands you run (init, plan, apply, destroy) and the HCL building blocks you write (resource, data, variable, output, and module blocks) plus everyday expressions like count, for_each, and conditionals. Each row pairs the exact command or block with a plain-English note on what it does. Type in the filter box to search across both columns, or tap a category button to focus on one area. The whole list is built into the page, so it works offline and sends nothing anywhere.

How to use it

Start typing in the Filter box. Entering plan surfaces the planning commands; entering for_each jumps to the looping construct; entering state shows the state subcommands. The category buttons (CLI, State, Blocks, Variables, Expressions, Workspaces) narrow the table to one area and combine with the text filter, so you can pick State and type rm to zero in on removing a resource from state. Clear the box to see the full sheet again.

Common use cases

  • Recalling the exact flags for a command you use rarely, like terraform apply -replace or terraform state mv.
  • Deciding between count and for_each when you need multiple copies of a resource.
  • Bringing an existing resource under management with terraform import instead of recreating it.
  • Configuring a remote backend so the state file lives in shared, locked storage rather than on one laptop.
  • Reviewing the core Terraform workflow before an interview or a new project.

Common pitfalls

  • Applying without reviewing the plan. Running terraform apply -auto-approve in the wrong directory can change or delete real infrastructure. Read the plan first, or save it with -out and apply that exact file.
  • Committing the state file. A local terraform.tfstate can hold secrets and is easy to clobber. Use a remote backend with locking so teammates do not overwrite each other.
  • Reaching for taint. terraform taint is deprecated. Use terraform apply -replace to force a single resource to be recreated.
  • Editing infrastructure by hand. Manual changes drift from the state, so the next plan may try to undo them. Run terraform plan to detect drift and bring changes back into the configuration.

Frequently asked questions

What does terraform plan do?
terraform plan compares your configuration against the current state and the real infrastructure, then prints the actions it would take: what it would create, change, or destroy. It does not modify anything, so it is safe to run any time to preview a change. Save the result with -out to guarantee that a later apply runs exactly the reviewed plan.
What is the difference between terraform plan and terraform apply?
plan is a read-only preview that shows the proposed changes and then stops. apply carries them out: by default it shows the same plan and waits for you to type yes before creating or changing anything. In short, plan tells you what will happen and apply makes it happen.
What is the Terraform state file?
The state file (terraform.tfstate) is how Terraform remembers which real resources it manages and maps them to the addresses in your configuration. It stores resource IDs and attributes so plan can tell what changed. It can contain secrets, so keep it in a secure remote backend rather than committing it to git.
What is a Terraform provider?
A provider is a plugin that lets Terraform talk to a specific platform or service, such as AWS, Google Cloud, Azure, or Kubernetes. It defines the resource and data source types you can use and handles the API calls. You configure providers in a provider block and pin their versions in the terraform block.
What does for_each do in Terraform?
for_each creates one instance of a resource or module for each item in a map or a set of strings. Inside the block you refer to the current item with each.key and each.value. Compared with count, for_each keys instances by a stable name rather than a numeric index, so adding or removing items does not shift the others.
What is the difference between count and for_each?
Both create multiple instances of a resource. count takes a number and indexes instances from zero, which is simple but means removing a middle item renumbers the rest. for_each takes a map or set and keys each instance by name, so instances stay stable when the collection changes. Prefer for_each when the items have meaningful identifiers.
Does this cheat sheet send my searches anywhere?
No. The whole command and block list is baked into the page and every search and filter runs locally in your browser with JavaScript, so nothing you type leaves your device. Open your browser DevTools and watch the Network tab while you search to confirm there are zero requests.

Embed this tool

Free for any use; attribution appreciated. Paste this on your site:

The embed runs the same tool that lives at this URL. No tracking; no ads inside the embed. Resize height as needed for your layout.

Cite this tool

For academic, journalistic, or technical references. Pick a format:

Citations use 2026 as the publication year. Access date is left as a fillable placeholder where the citation style expects one.

Embedded tool from glunty.com