Terraform Cheat Sheet

Updated 2026-07-29

Next Topic: Terraform CI CD, Security Scanning, and Policy as Code Cheat Sheet

🎯Take a practice test on this topic10 practice tests · 300 questions→

🧠Study flashcards on this topic151 cards · spaced repetition→

Terraform is HashiCorp's open-source infrastructure as code (IaC) tool that provisions and manages cloud and on-premises resources using declarative configuration files written in HashiCorp Configuration Language (HCL). It works by building a dependency graph of your infrastructure, determining the optimal execution order, and applying changes through provider-specific APIs to AWS, Azure, GCP, Kubernetes, and hundreds of other platforms. Understanding Terraform's workflow—write configuration, initialize providers, plan changes, apply infrastructure—is essential, but the real power lies in mastering state management, modules, meta-arguments, and the growing set of ephemeral and lifecycle features (including removed, ephemeral, and write-only arguments) that enable you to build scalable, maintainable, and secrets-safe infrastructure with minimal manual intervention.

What This Cheat Sheet Covers

This topic spans 30 focused tables and 255 indexed concepts, 151 flashcards, 10 practice tests with 300 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Core CLI CommandsTable 2: Configuration BlocksTable 3: Meta-ArgumentsTable 4: Lifecycle ArgumentsTable 5: Variable TypesTable 6: Variable Definition MethodsTable 7: Output ConfigurationTable 8: Backend TypesTable 9: State Management CommandsTable 10: String FunctionsTable 11: Collection FunctionsTable 12: Numeric and Type FunctionsTable 13: Encoding and Hash FunctionsTable 14: File and Path FunctionsTable 15: Date and Time FunctionsTable 16: IP and Network FunctionsTable 17: Conditional and Logic FunctionsTable 18: ExpressionsTable 19: ProvisionersTable 20: Special ResourcesTable 21: Workspace CommandsTable 22: Module SourcesTable 23: Version ConstraintsTable 24: Common Plan and Apply FlagsTable 25: Environment VariablesTable 26: Advanced State OperationsTable 27: Provider Configuration PatternsTable 28: Dependency Lock FileTable 29: Testing and ValidationTable 30: Best Practices and Patterns

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Core CLI Commands

These are the commands you'll type every day, and the four that matter most, init, plan, apply, destroy, trace the entire Terraform lifecycle from setting up a directory to tearing infrastructure down. The rest handle the supporting work of validating, formatting, importing existing resources, and inspecting state, with a couple of entries flagged deprecated so you reach for their modern replacements instead.

Command	Example	Description
terraform init	`terraform init`	Initializes a working directory, downloads provider plugins, and sets up the backend.
terraform plan	`terraform plan -out=tfplan`	• Generates an execution plan showing what actions Terraform will take • use `-out` to save for apply.
terraform apply	`terraform apply tfplan`	Executes the actions proposed in a plan, creating, updating, or deleting resources to match configuration.
terraform destroy	`terraform destroy`	• Destroys all resources managed by the current configuration • use `-target` to destroy specific resources.
terraform validate	`terraform validate`	Validates the syntax and internal consistency of configuration files without accessing remote services.
terraform fmt	`terraform fmt -recursive`	• Formats configuration files to a canonical style • use `-recursive` to format all subdirectories.
terraform import	`terraform import aws_instance.web i-1234567890abcdef0`	• Brings existing infrastructure under Terraform management by binding it to state • Does not generate matching configuration for you, write the resource block yourself or use `-generate-config-out`.
terraform state	`terraform state list`	• Manages the state file • supports subcommands: `list`, `show`, `mv`, `rm`, `pull`, `push`.
terraform output	`terraform output vpc_id`	• Extracts the value of an output variable from the state file • useful for passing values between modules.
terraform show	`terraform show`	Displays the current state or a saved plan in human-readable format.
terraform workspace	`terraform workspace new dev`	Manages multiple isolated state files for different environments within the same configuration.
terraform console	`terraform console`	Opens an interactive console for evaluating expressions and functions against the current state.
terraform test	`terraform test`	Runs automated tests defined in `.tftest.hcl` files to validate configuration behavior.
terraform graph	`terraform graph \| dot -Tpng > graph.png`	Generates a visual representation of the dependency graph in DOT format.
terraform force-unlock	`terraform force-unlock LOCK_ID`	• Manually unlocks the state when a previous operation left it locked • use only when safe to do so.
terraform providers	`terraform providers lock -platform=linux_amd64`	• Manages provider plugins via subcommands • `lock` generates multi-platform lock entries; `mirror` copies providers locally; `schema` prints provider schemas.
terraform refresh	`terraform apply -refresh-only`	• Updates state to match real infrastructure • deprecated standalone command, use `apply -refresh-only`.
terraform taint	`terraform apply -replace="aws_instance.web"`	• Marks a resource for recreation • deprecated, use `apply -replace` instead.

Table 2: Configuration Blocks

Blocks are the vocabulary of HCL—every .tf file is a collection of them. The familiar trio of resource, data, and module does the bulk of the work, while variable, output, and locals handle inputs and intermediate values. Watch for the newer arrivals like import, removed, check, and ephemeral, which add declarative ways to refactor state and keep secrets out of it entirely.

Block	Example	Description
terraform block	`terraform {` `required_version = ">= 1.0"` `}`	Configures Terraform behavior including required version, required providers, backend, cloud integration, and experimental features.

The rest of this section is part of the full cheat sheet

Table 3: Meta-Arguments

Meta-arguments are special keywords you can drop into almost any resource block to change how Terraform handles it. The big two, count and for_each, let one block create many instances, while depends_on, lifecycle, and provider control ordering, lifecycle behavior, and which provider configuration applies. They're the levers that turn static declarations into flexible, reusable infrastructure.

Meta-Argument	Example	Description
count	`count = 3`	Creates multiple instances of a resource using index-based references like `[0]`, `[1]`, `[2]`.

The rest of this section is part of the full cheat sheet

Table 4: Lifecycle Arguments

Inside the lifecycle block, these arguments fine-tune how Terraform creates, replaces, and destroys a resource. They solve very real headaches: create_before_destroy avoids downtime during replacements, prevent_destroy guards a production database from an accidental delete, and ignore_changes stops Terraform from fighting you over attributes something else manages. Preconditions and postconditions add assertion checks around the resource.

Argument	Example	Description
create_before_destroy	`create_before_destroy = true`	• Creates a replacement resource before destroying the old one • prevents downtime during updates.

The rest of this section is part of the full cheat sheet

Table 1: Core CLI Commands

Command	Example	Description
terraform init	`terraform init`	Initializes a working directory, downloads provider plugins, and sets up the backend.
terraform plan	`terraform plan -out=tfplan`	• Generates an execution plan showing what actions Terraform will take • use `-out` to save for apply.
terraform apply	`terraform apply tfplan`	Executes the actions proposed in a plan, creating, updating, or deleting resources to match configuration.
terraform destroy	`terraform destroy`	• Destroys all resources managed by the current configuration • use `-target` to destroy specific resources.
terraform validate	`terraform validate`	Validates the syntax and internal consistency of configuration files without accessing remote services.
terraform fmt	`terraform fmt -recursive`	• Formats configuration files to a canonical style • use `-recursive` to format all subdirectories.
terraform import	`terraform import aws_instance.web i-1234567890abcdef0`	• Brings existing infrastructure under Terraform management by binding it to state • Does not generate matching configuration for you, write the resource block yourself or use `-generate-config-out`.
terraform state	`terraform state list`	• Manages the state file • supports subcommands: `list`, `show`, `mv`, `rm`, `pull`, `push`.
terraform output	`terraform output vpc_id`	• Extracts the value of an output variable from the state file • useful for passing values between modules.
terraform show	`terraform show`	Displays the current state or a saved plan in human-readable format.
terraform workspace	`terraform workspace new dev`	Manages multiple isolated state files for different environments within the same configuration.
terraform console	`terraform console`	Opens an interactive console for evaluating expressions and functions against the current state.
terraform test	`terraform test`	Runs automated tests defined in `.tftest.hcl` files to validate configuration behavior.
terraform graph	`terraform graph \| dot -Tpng > graph.png`	Generates a visual representation of the dependency graph in DOT format.
terraform force-unlock	`terraform force-unlock LOCK_ID`	• Manually unlocks the state when a previous operation left it locked • use only when safe to do so.
terraform providers	`terraform providers lock -platform=linux_amd64`	• Manages provider plugins via subcommands • `lock` generates multi-platform lock entries; `mirror` copies providers locally; `schema` prints provider schemas.
terraform refresh	`terraform apply -refresh-only`	• Updates state to match real infrastructure • deprecated standalone command, use `apply -refresh-only`.
terraform taint	`terraform apply -replace="aws_instance.web"`	• Marks a resource for recreation • deprecated, use `apply -replace` instead.

Table 2: Configuration Blocks

Block	Example	Description
terraform block	`terraform {` `required_version = ">= 1.0"` `}`	Configures Terraform behavior including required version, required providers, backend, cloud integration, and experimental features.

Table 3: Meta-Arguments

Meta-Argument	Example	Description
count	`count = 3`	Creates multiple instances of a resource using index-based references like `[0]`, `[1]`, `[2]`.

Table 4: Lifecycle Arguments

Argument	Example	Description
create_before_destroy	`create_before_destroy = true`	• Creates a replacement resource before destroying the old one • prevents downtime during updates.