Terraform Workflow

Terraform Workflow

Infrastructure as Code practices with Terraform.

When to Use This Skill

Use this skill when:

• Managing infrastructure with Terraform
• Reviewing terraform plans
• Debugging state issues
• Following IaC best practices

Basic Workflow

Initialize

# Initialize working directory
terraform init

# Upgrade providers
terraform init -upgrade

# Reconfigure backend
terraform init -reconfigure

Plan

# Preview changes
terraform plan

# Save plan to file
terraform plan -out=tfplan

# Plan for specific target
terraform plan -target=aws_instance.example

# Plan destroy
terraform plan -destroy

Apply

# Apply changes (with approval)
terraform apply

# Apply saved plan (no approval needed)
terraform apply tfplan

# Auto-approve (use with caution!)
terraform apply -auto-approve

# Apply specific target
terraform apply -target=aws_instance.example

Destroy

# Plan destruction first
terraform plan -destroy

# Destroy with approval
terraform destroy

# Destroy specific resource
terraform destroy -target=aws_instance.example

State Management

View State

# List resources in state
terraform state list

# Show specific resource
terraform state show aws_instance.example

# Full state (sensitive!)
terraform show

State Operations

# Move resource (rename)
terraform state mv aws_instance.old aws_instance.new

# Remove from state (resource still exists)
terraform state rm aws_instance.example

# Import existing resource
terraform import aws_instance.example i-1234567890abcdef0

# Pull remote state locally
terraform state pull > terraform.tfstate.backup

State Locking

# Force unlock (use carefully!)
terraform force-unlock LOCK_ID

Workspaces

# List workspaces
terraform workspace list

# Create workspace
terraform workspace new staging

# Switch workspace
terraform workspace select production

# Current workspace
terraform workspace show

Validation & Formatting

# Validate configuration
terraform validate

# Format code
terraform fmt

# Format check (CI/CD)
terraform fmt -check

# Recursive format
terraform fmt -recursive

Output & Variables

View Outputs

# All outputs
terraform output

# Specific output
terraform output instance_ip

# JSON format
terraform output -json

Variable Files

# Use var file
terraform plan -var-file=production.tfvars

# Override variable
terraform plan -var="instance_type=t3.large"

Debugging

Verbose Logging

# Enable debug logging
export TF_LOG=DEBUG
terraform plan

# Log to file
export TF_LOG_PATH=terraform.log
terraform plan

# Disable logging
unset TF_LOG TF_LOG_PATH

Common Issues

Refresh State

# Update state with real infrastructure
terraform refresh

# Or use plan with refresh
terraform plan -refresh-only

Safe Practices

Plan Review Checklist

1. Check the summary: How many add/change/destroy?
2. Review destroys: Any unexpected deletions?
3. Check sensitive changes: IAM, security groups, encryption
4. Validate resource names: Especially for stateful resources
5. Look for force replacements: # forces replacement

Safe Apply Workflow

# 1. Always plan first
terraform plan -out=tfplan

# 2. Review plan carefully
terraform show tfplan

# 3. Apply saved plan
terraform apply tfplan

# 4. Verify changes
terraform show

Prevent Accidental Destroys

# In your terraform config
resource "aws_instance" "critical" {
  # ...

  lifecycle {
    prevent_destroy = true
  }
}

Module Management

# Get modules
terraform get

# Update modules
terraform get -update

# Show module tree
terraform providers

CI/CD Integration

GitHub Actions Example

- name: Terraform Plan
  run: |
    terraform init
    terraform plan -out=tfplan -no-color

- name: Terraform Apply
  if: github.ref == 'refs/heads/main'
  run: terraform apply -auto-approve tfplan

Plan Output for PR

# Generate plan for PR comment
terraform plan -no-color > plan.txt 2>&1

Cost Estimation

# With Infracost
infracost breakdown --path .

# Cost diff
infracost diff --path .

Security Scanning

# With tfsec
tfsec .

# With checkov
checkov -d .

# With trivy
trivy config .

Quick Reference

# Full workflow
terraform init && terraform plan -out=tfplan && terraform apply tfplan

# Check what would be destroyed
terraform plan -destroy | grep "will be destroyed"

# List all resources
terraform state list

# Import resource
terraform import aws_instance.name i-1234567890

# Taint for recreation
terraform taint aws_instance.example
terraform untaint aws_instance.example

Related Skills

• aws-ops: For AWS resource verification
• git-workflow: For IaC version control
• cost-optimization: For infrastructure costs