CLI #

# Basic initialization
terraform init

# Expected output:
# Initializing the backend...
# Initializing provider plugins...
# - Finding hashicorp/aws versions matching "~> 5.0"...
# - Installing hashicorp/aws v5.31.0...
# - Finding cloudflare/cloudflare versions matching "~> 4.0"...
# - Installing cloudflare/cloudflare v4.22.0...
# Terraform has been successfully initialized!

# Update providers to the latest version satisfying the constraint
terraform init -upgrade
# Use this when you want the newest provider versions

# Initialize without backend setup (for testing or migration)
terraform init -backend=false

# Force a backend reconfigure (when changing backends or moving state)
terraform init -reconfigure

# Migrate state from an old backend to a new one
terraform init -migrate-state

# Only download modules, skip backend and provider setup
terraform init -get-plugins=false

# After init, the directory will contain:
# .
# ├── .terraform/
# │   ├── providers/           # Provider binaries (DON'T commit)
# │   │   └── registry.terraform.io/
# │   └── modules/             # Downloaded modules
# ├── .terraform.lock.hcl      # Lock file (MUST commit)
# ├── main.tf
# └── variables.tf

# Basic plan
terraform plan

# Save the plan to a file (for deterministic applies)
terraform plan -out=tfplan
terraform apply tfplan  # Apply exactly the saved plan

# Override variables during plan
terraform plan -var="environment=production"
terraform plan -var-file="prod.tfvars"

# Plan only specific resources (useful for debugging)
terraform plan -target=aws_instance.web

# Skip state refresh (faster, but less accurate)
terraform plan -refresh=false

# Example plan output with various symbols:

# + create (a new resource will be created)
+ resource "aws_instance" "web" {
    + ami           = "ami-0abcdef1234567890"
    + instance_type = "t3.micro"
    + id            = (known after apply)
  }

# - destroy (the resource will be deleted)
- resource "aws_instance" "old" {
    - id = "i-0abcdef1234567890"
  }

# ~ update in-place (the resource is modified without replacement)
~ resource "aws_instance" "web" {
    ~ instance_type = "t3.micro" -> "t3.small"
      id            = "i-0abcdef1234567890"
  }

# -/+ destroy and recreate (a change that requires replacement)
-/+ resource "aws_instance" "web" {
    ~ ami = "ami-old" -> "ami-new"  # forces replacement
    - id  = "i-0abcdef1234567890"
    + id  = (known after apply)
  }

# Apply with interactive confirmation (default)
terraform apply
# Terraform will perform the following actions:
#   ... (plan output) ...
# Do you want to perform these actions?
#   Terraform will perform the actions described above.
#   Only 'yes' will be accepted to approve.
#   Enter a value: yes

# Apply without confirmation (for CI/CD)
terraform apply -auto-approve

# Apply from a saved plan (safest for production)
terraform plan -out=tfplan
terraform apply tfplan  # Exactly the saved plan, no confirmation prompt

# Override variables during apply
terraform apply -var="instance_type=t3.small"
terraform apply -var-file="prod.tfvars"

# Apply only specific resources (for targeted fixes)
terraform apply -target=aws_instance.web

# Limit the number of concurrent operations (default: 10)
terraform apply -parallelism=5
# Useful when the provider API has rate limits

# Refresh state before applying
terraform apply -refresh=true  # Default
terraform apply -refresh=false # Skip refresh (faster)

# Useful for targeted fixes
terraform apply -target=aws_instance.web

# ANTI-PATTERN: Using -target routinely
# - Makes state out of sync with the configuration
# - Untargeted resources can become inconsistent
# - Better to use -target only for debugging

# List all resources in state
terraform state list
# aws_instance.web
# aws_security_group.web
# aws_subnet.public[0]
# aws_subnet.public[1]
# aws_vpc.main

# View details of one resource
terraform state show aws_instance.web
# resource "aws_instance" "web" {
#     ami                     = "ami-0abcdef1234567890"
#     instance_type           = "t3.micro"
#     public_ip               = "54.123.45.67"
#     ...
# }

# Refresh state from the actual cloud condition
terraform refresh
# Re-reads all resources from the provider APIs
# Useful if there were manual changes outside Terraform

# Show output values
terraform output
terraform output -raw instance_public_ip  # Specific output, no quotes
terraform output -json                     # JSON format

# Format configuration files consistently
terraform fmt                 # Format all .tf files in the current directory
terraform fmt -recursive      # Include subdirectories
terraform fmt -check          # Check without changing (exit code 1 if formatting is needed)
terraform fmt -diff           # Show the formatting diff

# Validate configuration syntax
terraform validate
# Success! The configuration is valid.
# Validation doesn't connect to providers — it only checks HCL syntax

# RECOMMENDATION: Run before every commit
terraform fmt -check && terraform validate

# In CI/CD pipelines:
terraform fmt -check -recursive  # Fail if formatting is inconsistent
terraform validate               # Fail if there are syntax errors

# Enable detailed logging
TF_LOG=TRACE terraform apply   # Most verbose
TF_LOG=DEBUG terraform apply   # Very detailed
TF_LOG=INFO terraform apply    # General information
TF_LOG=WARN terraform apply    # Only warnings
TF_LOG=ERROR terraform apply   # Only errors

# Save logs to a file (useful for very long logs)
TF_LOG=DEBUG TF_LOG_PATH=terraform.log terraform apply
# Logs go to terraform.log, the terminal stays clean

# View the dependency graph (DOT format for Graphviz)
terraform graph
terraform graph | dot -Tpng > graph.png  # Visualize as an image
terraform graph -type=plan               # Graph of the plan, not the config