Terraform Commands - Complete Cheatsheet

terraform init

terraform init -backend-config="bucket=my-tf-state"

terraform init -upgrade

terraform init -backend=false

terraform init -reconfigure

terraform init -migrate-state

terraform init -plugin-dir=/path/to/plugins

terraform plan

terraform plan -out=tfplan

terraform plan -var-file="prod.tfvars"

terraform plan -var="instance_type=t3.large"

terraform plan -target=aws_instance.web

terraform plan -json

terraform plan -refresh=false

terraform plan -no-color | grep "^[[:space:]]*[#~+-]"

terraform show tfplan

terraform show -json tfplan

terraform apply

terraform apply -auto-approve

terraform apply tfplan

terraform apply -var-file="prod.tfvars"

terraform apply -target=aws_instance.web

terraform apply -parallelism=10

terraform apply -refresh-only

terraform destroy

terraform destroy -auto-approve

terraform destroy -target=aws_instance.web

terraform destroy -var-file="prod.tfvars"

terraform plan -destroy

terraform state list

terraform state show aws_instance.web

terraform state mv aws_instance.web aws_instance.web_server

terraform state rm aws_instance.web

terraform state pull

terraform state push terraform.tfstate

terraform state replace-provider hashicorp/aws registry.terraform.io/hashicorp/aws

cp terraform.tfstate terraform.tfstate.backup

terraform plan -refresh-only

terraform apply -refresh-only -var-file="prod.tfvars"

terraform apply -refresh-only -auto-approve

terraform output

terraform output instance_ip

terraform output -json

terraform output -raw public_key

terraform validate

terraform fmt

terraform fmt -diff

terraform fmt -recursive

terraform fmt -check

terraform workspace list

terraform workspace new dev

terraform workspace select prod

terraform workspace show

terraform workspace delete dev

terraform import aws_instance.web i-1234567890abcdef0

terraform import -var-file="prod.tfvars" aws_instance.web i-1234567890abcdef0

terraform import -state=path/to/terraform.tfstate aws_instance.web i-1234567890abcdef0

terraform taint aws_instance.web

terraform untaint aws_instance.web

terraform taint module.vpc.aws_subnet.private

terraform graph

terraform graph | dot -Tpng > graph.png

terraform graph -type=plan

terraform providers

terraform providers schema

terraform providers lock

terraform providers mirror /path/to/mirror

terraform console

echo "var.instance_type" | terraform console

echo "aws_instance.web.public_ip" | terraform console

terraform version

terraform version -json

terraform plan -help

terraform -help

terraform force-unlock <lock-id>

terraform state pull | jq '.version'

terraform state list | sort

terraform state pull > state.json

terraform state show -json aws_instance.web | jq '.values.public_ip'

export TF_LOG=DEBUG
terraform apply

export TF_LOG_PATH=./terraform.log
export TF_LOG=TRACE
terraform apply

export TF_VAR_instance_type=t3.large
terraform plan

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
terraform apply

export TF_CLI_ARGS="-no-color"
terraform plan

terraform test

terraform test -filter=test_instance

terraform test -var-file="test.tfvars"

terraform console
> var.region

grep -r "variable" *.tf

terraform validate 2>&1 | grep "var."

terraform apply -lock=true -lock-timeout=5m

terraform plan -backend-config="key=prod/terraform.tfstate"

terraform get

terraform get -update

terraform init -get=true

terraform login

terraform logout

terraform show

terraform show -json

terraform state show aws_instance.web

terraform apply -replace=aws_instance.web

terraform apply -replace=aws_instance.web -replace=aws_instance.db

export TF_LOG_CORE=TRACE
export TF_LOG_PROVIDER=TRACE
terraform apply

terraform providers schema -json | jq .

terraform graph | grep -i cycle

terraform apply -lock=false

terraform apply -lock-timeout=10m

terraform init \
  -backend-config="bucket=my-bucket" \
  -backend-config="key=terraform.tfstate" \
  -backend-config="region=us-east-1"

terraform apply -parallelism=5

terraform apply -parallelism=1

# Check lock status
cat .terraform/terraform.tfstate
 
# Force unlock (use with caution!)
terraform force-unlock <lock-id>
 
# Pull state from remote
terraform state pull > backup.tfstate
 
# If corrupted, restore from backup
terraform state push backup.tfstate
 
# Re-initialize if needed
terraform init -reconfigure

# Step 1: Write configuration for the resource
cat > main.tf &lt;<EOF
resource "aws_instance" "web" {
  # Configuration will be populated after import
  lifecycle {
    prevent_destroy = false
  }
}
EOF
 
# Step 2: Import the resource
terraform import aws_instance.web i-1234567890abcdef0
 
# Step 3: Get current state
terraform state show aws_instance.web
 
# Step 4: Update configuration to match state
# Step 5: Plan to verify no changes
terraform plan

# Move resource from one module to another
terraform state mv module.old.aws_instance.web module.new.aws_instance.web
 
# Verify the move
terraform plan  # Should show no changes

# Detect drift
terraform plan -refresh-only
 
# Sync state with actual infrastructure
terraform apply -refresh-only
 
# Or fix the drift by reapplying
terraform apply

# Step 1: Backup state
terraform state pull > pre-upgrade-state.json
 
# Step 2: Upgrade Terraform binary
# (download new version)
 
# Step 3: Upgrade provider versions
terraform init -upgrade
 
# Step 4: Verify with plan
terraform plan
 
# Step 5: Test in non-prod first
terraform workspace select dev
terraform plan

# Option 1: Workspaces
terraform workspace new prod
terraform workspace new staging
terraform workspace select prod
terraform apply -var-file=prod.tfvars
 
# Option 2: Directories (preferred for different backends)
cd environments/prod
terraform init -backend-config=backend-prod.hcl
terraform apply

# Mark outputs as sensitive
output "db_password" {
  value     = random_password.db.result
  sensitive = true
}
 
# Enable encryption at rest for remote backend
terraform {
  backend "s3" {
    bucket         = "my-tf-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/abcd1234"
    dynamodb_table = "terraform-locks"
  }
}
 
# Never commit state files to git
echo "*.tfstate" >> .gitignore
echo "*.tfstate.*" >> .gitignore

# Check for locks
terraform force-unlock <lock-id>
 
# If remote backend, check backend storage
# For S3:
aws s3 ls s3://my-tf-state-bucket/
 
# For Azure:
az storage blob list --account-name mystorageaccount --container-name tfstate
 
# Verify state file integrity
terraform state pull | jq .

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

aws s3api put-bucket-versioning \
  --bucket my-terraform-state \
  --versioning-configuration Status=Enabled

# .gitignore
*.tfstate
*.tfstate.*
.terraform/
*.tfvars  # if contains secrets

module "vpc" {
  source  = "./modules/vpc"
  version = "1.0.0"
  
  cidr_block = var.vpc_cidr
  environment = var.environment
}

terraform/
├── modules/
│   ├── vpc/
│   ├── eks/
│   └── rds/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── terraform.tfvars
│   ├── staging/
│   └── prod/
└── global/
    └── iam/

# Resource naming
resource "aws_instance" "web_server" {  # snake_case
  tags = {
    Name        = "web-server-${var.environment}"  # kebab-case for AWS
    Environment = var.environment
    ManagedBy   = "Terraform"
  }
}

# Bad
provider "aws" {
  access_key = "AKIAIOSFODNN7EXAMPLE"
  secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
 
# Good - use environment variables or IAM roles
provider "aws" {
  region = var.aws_region
}

variable "db_password" {
  type      = string
  sensitive = true
}
 
output "db_password" {
  value     = var.db_password
  sensitive = true
}

resource "aws_db_instance" "main" {
  storage_encrypted = true
  kms_key_id       = aws_kms_key.db.arn
}

resource "aws_iam_role_policy" "example" {
  role   = aws_iam_role.example.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["ec2:DescribeInstances"]
        Resource = "*"
      }
    ]
  })
}

resource "aws_db_instance" "production" {
  deletion_protection = true
  
  lifecycle {
    prevent_destroy = true
  }
}

terraform {
  required_version = ">= 1.6.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # Allow patch updates only
    }
  }
}

# Pessimistic constraint (recommended)
version = "~> 1.0"  # >= 1.0, < 2.0
 
# Exact version (most restrictive)
version = "1.2.3"
 
# Greater than
version = ">= 1.0"
 
# Range
version = ">= 1.0, < 2.0"

# Terraform usually auto-detects dependencies
# Use depends_on only when needed
resource "aws_instance" "web" {
  depends_on = [aws_security_group.web]
}

terraform apply -parallelism=5

# for_each - better for managing individual resources
resource "aws_instance" "web" {
  for_each = toset(["web-1", "web-2", "web-3"])
  
  tags = {
    Name = each.key
  }
}
 
# count - simpler for identical resources
resource "aws_instance" "app" {
  count = 3
  
  tags = {
    Name = "app-${count.index}"
  }
}

terraform validate
terraform fmt -check
terraform plan

# tests/main.tftest.hcl
run "verify_instance_type" {
  assert {
    condition     = aws_instance.web.instance_type == "t3.micro"
    error_message = "Instance type must be t3.micro"
  }
}

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.83.0
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
      - id: terraform_docs

variable "instance_type" {
  description = "EC2 instance type for web servers"
  type        = string
  default     = "t3.micro"
  
  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium"], var.instance_type)
    error_message = "Instance type must be t3.micro, t3.small, or t3.medium."
  }
}

output "web_server_public_ip" {
  description = "Public IP address of the web server"
  value       = aws_instance.web.public_ip
}

# VPC Module
 
## Usage
 
```hcl
module "vpc" {
  source = "./modules/vpc"
  
  cidr_block  = "10.0.0.0/16"
  environment = "production"
}

### 8. CI/CD Best Practices

**Implement automated planning**
```yaml
# GitHub Actions example
- name: Terraform Plan
  run: |
    terraform init
    terraform plan -out=tfplan
    
- name: Save Plan
  uses: actions/upload-artifact@v4
  with:
    name: tfplan
    path: tfplan

- name: Terraform Apply
  if: github.ref == 'refs/heads/main' && github.event_name == 'push'
  run: terraform apply -auto-approve tfplan
  environment: production

terraform {
  backend "s3" {
    bucket         = "terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

# variables.tf
variable "instance_type" {
  type = string
}
 
# prod.tfvars
instance_type = "t3.large"

module "vpc" {
  source = "./modules/vpc"
  cidr   = var.vpc_cidr
}

variable "db_password" {
  sensitive = true
}

required_providers {
  aws = {
    source  = "hashicorp/aws"
    version = "~> 5.0"
  }
}

resource "aws_db_instance" "prod" {
  lifecycle {
    prevent_destroy = true
  }
}

variable "environment" {
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

environments/
├── networking/
├── compute/
├── database/
└── security/

*.tfstate
*.tfstate.*
.terraform/
.terraform.lock.hcl  # optional
*.tfvars  # if contains secrets

terraform workspace select staging
terraform plan
terraform apply
# Test thoroughly
terraform workspace select prod
terraform apply

# count - index-based
resource "aws_instance" "app" {
  count = 3
  # Accessed as aws_instance.app[0]
}
 
# for_each - key-based (preferred)
resource "aws_instance" "web" {
  for_each = toset(["web-1", "web-2"])
  # Accessed as aws_instance.web["web-1"]
}

# Variable - user input
variable "environment" {
  type = string
}
 
# Local - computed
locals {
  common_tags = {
    Environment = var.environment
    ManagedBy   = "Terraform"
  }
}

# Workspaces - same backend, different state
terraform workspace new prod
terraform workspace new staging
 
# Directories - separate backends
cd environments/prod
terraform init -backend-config=backend-prod.hcl

# Data source - read existing
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]
}
 
# Resource - create new
resource "aws_instance" "web" {
  ami = data.aws_ami.ubuntu.id
}

# Old way (deprecated)
terraform taint aws_instance.web
terraform apply
 
# New way (preferred)
terraform apply -replace=aws_instance.web

terraform-infrastructure/
├── .gitignore
├── README.md
├── versions.tf                # Terraform & provider versions
├── main.tf                    # Main configuration
├── variables.tf               # Input variables
├── outputs.tf                 # Output values
├── locals.tf                  # Local values
├── data.tf                    # Data sources
├── terraform.tfvars           # Default values (non-sensitive)
├── backend.tf                 # Backend configuration
│
├── modules/
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   ├── eks/
│   ├── rds/
│   └── security-group/
│
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   │   └── backend.hcl
│   ├── staging/
│   └── prod/
│       ├── main.tf
│       ├── variables.tf
│       ├── prod.tfvars
│       ├── backend.hcl
│       └── README.md
│
└── tests/
    ├── main.tftest.hcl
    └── integration/

terraform {
  required_version = ">= 1.6.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

variable "environment" {
  description = "Environment name (dev, staging, prod)"
  type        = string
  
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}
 
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  
  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "Must be a valid IPv4 CIDR block."
  }
}
 
variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
  default     = ["us-east-1a", "us-east-1b", "us-east-1c"]
}
 
variable "private_subnet_cidrs" {
  description = "CIDR blocks for private subnets"
  type        = list(string)
}
 
variable "public_subnet_cidrs" {
  description = "CIDR blocks for public subnets"
  type        = list(string)
}
 
variable "enable_nat_gateway" {
  description = "Enable NAT Gateway for private subnets"
  type        = bool
  default     = true
}
 
variable "single_nat_gateway" {
  description = "Use single NAT Gateway for all private subnets"
  type        = bool
  default     = false
}
 
variable "tags" {
  description = "Additional tags for resources"
  type        = map(string)
  default     = {}
}

locals {
  common_tags = merge(
    var.tags,
    {
      Environment = var.environment
      ManagedBy   = "Terraform"
      Module      = "vpc"
    }
  )
}
 
# VPC
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-vpc"
    }
  )
}
 
# Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-igw"
    }
  )
}
 
# Public Subnets
resource "aws_subnet" "public" {
  count = length(var.public_subnet_cidrs)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnet_cidrs[count.index]
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-public-subnet-${count.index + 1}"
      Type = "public"
    }
  )
}
 
# Private Subnets
resource "aws_subnet" "private" {
  count = length(var.private_subnet_cidrs)
  
  vpc_id            = aws_vpc.main.id
  cidr_block        = var.private_subnet_cidrs[count.index]
  availability_zone = var.availability_zones[count.index]
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-private-subnet-${count.index + 1}"
      Type = "private"
    }
  )
}
 
# Elastic IPs for NAT Gateways
resource "aws_eip" "nat" {
  count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnet_cidrs)) : 0
  
  domain = "vpc"
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-nat-eip-${count.index + 1}"
    }
  )
  
  depends_on = [aws_internet_gateway.main]
}
 
# NAT Gateways
resource "aws_nat_gateway" "main" {
  count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnet_cidrs)) : 0
  
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-nat-${count.index + 1}"
    }
  )
  
  depends_on = [aws_internet_gateway.main]
}
 
# Public Route Table
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-public-rt"
      Type = "public"
    }
  )
}
 
# Public Route
resource "aws_route" "public_internet_gateway" {
  route_table_id         = aws_route_table.public.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.main.id
}
 
# Public Route Table Associations
resource "aws_route_table_association" "public" {
  count = length(var.public_subnet_cidrs)
  
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}
 
# Private Route Tables
resource "aws_route_table" "private" {
  count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnet_cidrs)) : length(var.private_subnet_cidrs)
  
  vpc_id = aws_vpc.main.id
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-private-rt-${count.index + 1}"
      Type = "private"
    }
  )
}
 
# Private Routes to NAT Gateway
resource "aws_route" "private_nat_gateway" {
  count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnet_cidrs)) : 0
  
  route_table_id         = aws_route_table.private[count.index].id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.main[count.index].id
}
 
# Private Route Table Associations
resource "aws_route_table_association" "private" {
  count = length(var.private_subnet_cidrs)
  
  subnet_id      = aws_subnet.private[count.index].id
  route_table_id = var.single_nat_gateway ? aws_route_table.private[0].id : aws_route_table.private[count.index].id
}
 
# VPC Flow Logs
resource "aws_flow_log" "main" {
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.flow_log.arn
  traffic_type    = "ALL"
  vpc_id          = aws_vpc.main.id
  
  tags = merge(
    local.common_tags,
    {
      Name = "${var.environment}-vpc-flow-log"
    }
  )
}
 
resource "aws_cloudwatch_log_group" "flow_log" {
  name              = "/aws/vpc/${var.environment}"
  retention_in_days = 30
  
  tags = local.common_tags
}
 
resource "aws_iam_role" "flow_log" {
  name = "${var.environment}-vpc-flow-log-role"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "vpc-flow-logs.amazonaws.com"
        }
      }
    ]
  })
  
  tags = local.common_tags
}
 
resource "aws_iam_role_policy" "flow_log" {
  name = "${var.environment}-vpc-flow-log-policy"
  role = aws_iam_role.flow_log.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogGroups",
          "logs:DescribeLogStreams"
        ]
        Effect = "Allow"
        Resource = "*"
      }
    ]
  })
}

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}
 
output "vpc_cidr" {
  description = "CIDR block of the VPC"
  value       = aws_vpc.main.cidr_block
}
 
output "public_subnet_ids" {
  description = "IDs of public subnets"
  value       = aws_subnet.public[*].id
}
 
output "private_subnet_ids" {
  description = "IDs of private subnets"
  value       = aws_subnet.private[*].id
}
 
output "nat_gateway_ids" {
  description = "IDs of NAT Gateways"
  value       = aws_nat_gateway.main[*].id
}
 
output "internet_gateway_id" {
  description = "ID of Internet Gateway"
  value       = aws_internet_gateway.main.id
}

terraform {
  required_version = ">= 1.6.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  
  backend "s3" {}  # Configuration in backend.hcl
}
 
provider "aws" {
  region = var.aws_region
  
  default_tags {
    tags = {
      Environment = "production"
      Project     = "my-project"
      ManagedBy   = "Terraform"
      CostCenter  = "engineering"
    }
  }
}
 
module "vpc" {
  source = "../../modules/vpc"
  
  environment          = var.environment
  vpc_cidr            = var.vpc_cidr
  availability_zones   = var.availability_zones
  public_subnet_cidrs  = var.public_subnet_cidrs
  private_subnet_cidrs = var.private_subnet_cidrs
  enable_nat_gateway   = true
  single_nat_gateway   = false
  
  tags = var.additional_tags
}

bucket         = "my-terraform-state-prod"
key            = "prod/vpc/terraform.tfstate"
region         = "us-east-1"
encrypt        = true
dynamodb_table = "terraform-state-lock-prod"
kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/abc-def-ghi"

aws_region     = "us-east-1"
environment    = "prod"
vpc_cidr       = "10.0.0.0/16"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
 
public_subnet_cidrs = [
  "10.0.1.0/24",
  "10.0.2.0/24",
  "10.0.3.0/24"
]
 
private_subnet_cidrs = [
  "10.0.11.0/24",
  "10.0.12.0/24",
  "10.0.13.0/24"
]
 
additional_tags = {
  Owner       = "platform-team"
  CostCenter  = "engineering"
  Compliance  = "pci"
}

# Local .terraform directories
**/.terraform/*

# .tfstate files
*.tfstate
*.tfstate.*

# Crash log files
crash.log
crash.*.log

# Exclude all .tfvars files (if they contain secrets)
*.tfvars
*.tfvars.json

# Ignore override files
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# Include example tfvars
!example.tfvars

# Ignore CLI configuration files
.terraformrc
terraform.rc

# Ignore plan files
*.tfplan

# Ignore lock files (optional)
.terraform.lock.hcl

resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id
  
  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = "tcp"
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
}

resource "aws_instance" "web" {
  count = var.create_instance ? 1 : 0
  
  ami           = var.ami_id
  instance_type = var.instance_type
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]  # Canonical
  
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
}

data "terraform_remote_state" "vpc" {
  backend = "s3"
  
  config = {
    bucket = "my-terraform-state"
    key    = "vpc/terraform.tfstate"
    region = "us-east-1"
  }
}
 
resource "aws_instance" "app" {
  subnet_id = data.terraform_remote_state.vpc.outputs.private_subnet_ids[0]
}

provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}
 
provider "aws" {
  alias  = "us_west_2"
  region = "us-west-2"
}
 
resource "aws_instance" "east" {
  provider = aws.us_east_1
}
 
resource "aws_instance" "west" {
  provider = aws.us_west_2
}

terraform plan -refresh-only

terraform plan -refresh-only -out=drift.tfplan
terraform show drift.tfplan

terraform apply -refresh-only -auto-approve

terraform state pull | jq '.resources[] | {type: .type, name: .name}'

# AWS
export AWS_PROFILE=production
export AWS_DEFAULT_REGION=us-east-1
 
# Azure
export ARM_SUBSCRIPTION_ID="xxx"
export ARM_TENANT_ID="xxx"
export ARM_CLIENT_ID="xxx"
export ARM_CLIENT_SECRET="xxx"
 
# GCP
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json"
export GOOGLE_PROJECT="my-project-id"
 
terraform plan

terraform init

terraform plan -out=multi-cloud.tfplan

# main.tf
import {
  to = aws_instance.web
  id = "i-1234567890abcdef0"
}
 
resource "aws_instance" "web" {
  # Configuration
}

terraform plan -generate-config-out=generated.tf
terraform apply

import {
  to = aws_instance.web1
  id = "i-111111111"
}
 
import {
  to = aws_instance.web2
  id = "i-222222222"
}

terraform plan -generate-config-out=imported.tf

check "health_check" {
  data "http" "example" {
    url = "https://${aws_instance.web.public_ip}"
  }
 
  assert {
    condition     = data.http.example.status_code == 200
    error_message = "Website is not responding"
  }
}

terraform plan  # Runs checks
terraform apply # Runs checks again

moved {
  from = aws_instance.web
  to   = aws_instance.web_server
}

moved {
  from = aws_instance.web
  to   = module.web.aws_instance.main
}

terraform plan  # Should show no changes

removed {
  from = aws_instance.old_server
 
  lifecycle {
    destroy = false
  }
}

removed {
  from = aws_instance.temporary
 
  lifecycle {
    destroy = true
  }
}

export TF_LOG=TRACE
export TF_LOG_CORE=DEBUG
export TF_LOG_PROVIDER=TRACE
export TF_LOG_PATH=./terraform-debug.log
terraform apply

TF_LOG=DEBUG terraform plan 2>&1 | tee plan-debug.log

export TF_LOG_PROVIDER=TRACE
terraform apply -auto-approve

export TF_LOG=DEBUG
terraform apply 2>&1 | grep -i "lock"

ls -la ~/.terraform.d/plugin-cache/
terraform providers

terraform apply -parallelism=3

terraform plan -target=module.specific_module

terraform init -backend=false -get=false -verify-plugins=false

terraform apply -compact-warnings

terraform state pull > "backup-$(date +%Y%m%d-%H%M%S).tfstate"

terraform state push backup-20240101-120000.tfstate

diff <(terraform state pull | jq -S .) <(cat backup.tfstate | jq -S .)

terraform state pull | jq '.resources' > resources.json

data "aws_ssm_parameter" "db_password" {
  name            = "/prod/db/password"
  with_decryption = true
}
 
resource "aws_db_instance" "main" {
  password = data.aws_ssm_parameter.db_password.value
}

data "azurerm_key_vault_secret" "db_password" {
  name         = "db-password"
  key_vault_id = data.azurerm_key_vault.main.id
}

data "vault_generic_secret" "db_creds" {
  path = "secret/database/prod"
}
 
resource "aws_db_instance" "main" {
  username = data.vault_generic_secret.db_creds.data["username"]
  password = data.vault_generic_secret.db_creds.data["password"]
}

terraform apply -target=module.vpc

terraform apply \
  -target=aws_instance.web \
  -target=aws_security_group.web

terraform apply -target=module.eks.aws_eks_cluster.main

terraform destroy -target=module.old_infrastructure

# main.tf.json
{
  "resource": {
    "aws_instance": {
      "web": {
        "ami": "ami-12345678",
        "instance_type": "t3.micro"
      }
    }
  }
}

terraform validate

# No native command, use tools like hcl2json

module "vpc" {
  source  = "app.terraform.io/my-org/vpc/aws"
  version = "1.0.0"
}

terraform login app.terraform.io

# Tag version in Git
git tag v1.0.0
git push origin v1.0.0
# Registry auto-publishes

# override.tf
resource "aws_instance" "web" {
  instance_type = "t2.micro"  # Override for dev
}

# Terraform automatically loads:
# - override.tf
# - override.tf.json
# - *_override.tf
# - *_override.tf.json

data "external" "example" {
  program = ["python3", "${path.module}/script.py"]
  
  query = {
    environment = var.environment
  }
}
 
output "result" {
  value = data.external.example.result
}

data "template_file" "user_data" {
  template = file("${path.module}/user_data.sh")
  
  vars = {
    environment = var.environment
    region      = var.region
  }
}

resource "null_resource" "example" {
  triggers = {
    always_run = timestamp()
  }
  
  provisioner "local-exec" {
    command = "echo 'Resource updated'"
  }
}

resource "aws_instance" "web" {
  # ...
  
  provisioner "remote-exec" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get install -y nginx"
    ]
    
    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = file("~/.ssh/id_rsa")
      host        = self.public_ip
    }
  }
}

resource "aws_instance" "web" {
  # ...
  
  provisioner "file" {
    source      = "app.conf"
    destination = "/etc/app/app.conf"
    
    connection {
      type = "ssh"
      user = "ubuntu"
      host = self.public_ip
    }
  }
}

terraform {
  cloud {
    organization = "my-org"
    
    workspaces {
      name = "production"
    }
  }
}

terraform {
  cloud {
    organization = "my-org"
    
    workspaces {
      tags = ["production", "us-east-1"]
    }
  }
}