Terraform Professional cheat sheet

for expressions build lists with [for s in var.list : upper(s)] and maps with {for k, v in var.map : k => upper(v)}; an if clause filters elements.

Splat expressions [*] project a list attribute across all instances; one() safely returns a single element or null from a zero/one-element collection.

A dynamic block uses for_each to generate repeated nested blocks; iterator renames the temporary variable and content defines each block body.

Variable validation requires a condition that evaluates to bool plus error_message; in current Terraform the condition may reference only that variable.

Lifecycle settings include create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by, and precondition/postcondition.

Use moved blocks to change a resource or module address without destroy/create; use import blocks plus -generate-config-out to adopt existing objects.

try() returns the first argument that evaluates without error; can() returns bool for whether an expression succeeds; coalesce() returns the first non-null/non-empty argument.

depends_on creates explicit whole-object dependencies for resources or modules; it does not accept arbitrary value expressions.

State maps declared resources to real remote objects and stores attribute values; it may contain sensitive values in plaintext even when variables are marked sensitive.

The S3 backend supports state locking through dynamodb_table or newer lockfile support, plus encrypt, bucket, key, and region settings.

terraform state list lists addresses, state show prints one object, state mv changes addresses, and state rm removes an object from state without destroying it.

terraform import and import blocks adopt existing infrastructure; importing populates state but does not author configuration unless -generate-config-out is used.

terraform apply -refresh-only or plan -refresh-only reconciles state with remote objects without applying configuration changes.

Partial backend configuration uses terraform init -backend-config=...; -reconfigure ignores prior backend state, while -migrate-state attempts to copy it.

terraform_remote_state reads only declared outputs from another state; it requires access to that backend and should not be used to fetch resource attributes.

terraform workspace manages named state instances; in the local backend workspaces are directories, while remote backends use workspace-specific state keys.

terraform force-unlock <LOCK_ID> clears a stuck lock only after confirming no operation is still running.

A module block requires source; registry sources accept a version constraint, and count or for_each instantiate multiple module instances.

Module for_each keys must be known at plan time; addresses appear as module.name["key"], while count addresses use integer indexes.

required_providers declares provider source addresses and version constraints; configuration_aliases declares additional provider configurations a module expects.

Callers pass provider configurations through the module block's providers map; reusable child modules should not contain their own provider blocks.

terraform init downloads modules into .terraform/modules; terraform get -update refreshes installed modules without a full init.

Registry modules use the address form namespace/name/provider; publishing requires semantic version tags such as v1.2.3.

Module outputs are the only values callers can reference; mark outputs sensitive when they expose secrets.

Prefer small composable modules with explicit variables and outputs; avoid hidden dependencies on root-level resources.

The cloud block configures HCP Terraform or Terraform Enterprise integration with organization and either workspaces.name or workspaces.tags.

Workspace run modes include CLI-driven, VCS-driven, and API-driven; remote runs execute plan and apply in HCP Terraform's environment.

A VCS-driven run queues when the connected repository changes; workspace settings control auto-apply versus manual confirmation.

Variable sets are reusable collections of Terraform and environment variables applied to projects or workspaces; workspace-specific variables can override values.

Run triggers queue a dependent workspace's run after a source workspace applies successfully, chaining infrastructure layers.

Policy checks evaluate Sentinel policies between plan and apply; failed policies can block the run depending on policy enforcement level.

Run tasks call external systems before or after plan/apply to perform custom validation or approval checks.

Authenticate the CLI with terraform login or a TF_TOKEN_<hostname> environment variable for remote workspaces and private registries.

.terraform.lock.hcl records selected provider versions and checksums; commit it to version control so installs are reproducible across machines and CI.

terraform providers lock -platform=... adds checksums for additional operating systems and architectures to the lock file.

The ~> pessimistic constraint allows patch updates within a minor version with two segments, or minor updates within a major version with one segment.

A provider source address has the form [hostname/]namespace/type, for example registry.terraform.io/hashicorp/aws, and belongs in required_providers.

required_version constrains the Terraform CLI version; required_providers constrains each provider with source and version.

terraform init -upgrade re-selects newer module and provider versions that still satisfy constraints and updates the lock file.

terraform providers displays the provider dependency tree; terraform providers mirror copies providers into a local filesystem mirror.

TF_PLUGIN_CACHE_DIR or plugin_cache_dir reuses downloaded provider packages across configurations.

sensitive = true on variables and outputs redacts values in CLI output; it does not encrypt state or prevent storage of the value in state.

The nonsensitive() function reveals a sensitive value intentionally; sensitive() marks an expression as sensitive.

Ephemeral variables and resources in Terraform 1.10+ keep values out of state and plan files, which suits short-lived credentials.

Native testing uses .tftest.hcl files with run blocks, command = plan|apply, assert conditions, variables, and provider mocks.

terraform show -json converts a saved plan or state to JSON for policy engines such as OPA, Conftest, or custom validators.

Terraform Enterprise and HCP Terraform support Sentinel policy as code; enforcement levels determine whether violations block applies.

check blocks evaluate assertions during plan and apply and report warnings without failing the operation.

precondition and postcondition blocks fail an operation when conditions are false; postcondition can reference self attributes.