Terraform Cheatsheet

Updated September 2026 · Quick reference

Terraform describes cloud infrastructure as code. You plan changes, then apply them to reach the desired state.

Keep state secure, use modules for reuse, and never apply unreviewed plans in shared environments.

Workflow

init

Download providers and set up the backend.

terraform init

fmt / validate

Format and check configuration syntax.

terraform fmt
terraform validate

plan

Show what would change without applying.

terraform plan -out=tfplan

apply / destroy

Apply a saved plan, or tear down managed resources.

terraform apply tfplan
terraform destroy

version

Confirm CLI version; pin required_version in code for teams.

terraform version

HCL building blocks

Provider

Plugins that talk to APIs (AWS, Azure, GCP, etc.).

provider "aws" {
  region = "us-east-1"
}

Resource

A managed object. Type and local name form the address.

resource "aws_s3_bucket" "logs" {
  bucket = "example-logs-123"
}

Variable / output

Inputs and exported values for modules and root modules.

variable "region" { type = string }
output "bucket_id" { value = aws_s3_bucket.logs.id }

Data source

Read existing information without managing the object.

data "aws_ami" "ubuntu" {
  most_recent = true
  # filters...
}

State & modules

State

Maps resources to real objects. Store remotely for teams (S3, Terraform Cloud, etc.).

terraform state list
terraform state show aws_s3_bucket.logs

Backend peek

Configure remote state in a backend block, then re-init.

terraform {
  backend "s3" {
    bucket = "tf-state"
    key    = "proj/terraform.tfstate"
    region = "us-east-1"
  }
}

Module

Reusable configuration called like a resource.

module "network" {
  source = "./modules/network"
  cidr   = "10.0.0.0/16"
}

terraform.tfvars

Assign variable values; keep secrets out of git.

region = "us-east-1"

Expressions & tips

Interpolation

Reference attributes with resource_type.name.attr.

bucket = aws_s3_bucket.logs.id

count / for_each

Create multiple similar resources carefully.

resource "aws_subnet" "private" {
  for_each = toset(var.azs)
  # ...
}

Depends on

Prefer implicit refs; use depends_on only when the graph cannot see a dependency.

depends_on = [aws_iam_role_policy_attachment.x]

Workspaces peek

Lightweight state separation—often replaced by separate roots or directories for real envs.

terraform workspace list

Comments

One comment per signed-in account. Comments are saved with this page’s URL.