Vib795 Copilot Anatomy Terraform Plan

Terraform/OpenTofu — safe change workflow

Golden rule

Always plan before apply. Always verify workspace before either.

tofu workspace show     # confirm environment (dev/staging/prod)
tofu workspace list     # list all workspaces

Standard workflow

# 1. Init (first time or after provider changes)
tofu init -backend-config=backend-<env>.hcl

# 2. Plan — save to file for reviewable, reproducible apply
tofu plan -var-file=vars-<env>.tfvars -out=tfplan-<env>

# 3. Review the plan
tofu show tfplan-<env>

# 4. Apply (for prod: requires team review of the plan file first)
tofu apply tfplan-<env>

Plan output symbols

State management

tofu state list                                           # list managed resources
tofu state show aws_eks_cluster.main                      # inspect a resource
tofu state mv old_address new_address                     # safe refactor/rename
tofu state rm <address>                                   # remove without destroy

Common errors

State lock: another apply is running or crashed.

tofu force-unlock <lock-id>   # only if you're CERTAIN no apply is in progress

Provider version mismatch: tofu init -upgrade

Backend auth failure: check TF_HTTP_PASSWORD env var and Bento service status.

Required env vars

export AWS_PROFILE=<profile>
export AWS_REGION=us-east-1
export TF_HTTP_PASSWORD=<bento-token>

Source: vib795/copilot-anatomy — distributed by TomeVault.