Terraform CLI Overview

This topic provides an overview of the Terraform command line interface.

Hands-on: Try theTerraform: Get Started tutorials.

Introduction

The command line interface to Terraform is theterraform command, whichaccepts a variety of subcommands such asterraform init orterraform plan.

We refer to theterraform command line tool as "Terraform CLI" elsewherein the documentation. This terminology is often used to distinguish it fromother components you might use in the Terraform product family, such asHCP Terraform orthe variousTerraform providers, whichare developed and released separately from Terraform CLI.

To view a list of the commands available in your current Terraform version,runterraform with no additional arguments:

Usage: terraform [global options] <subcommand> [args]The available commands for execution are listed below.The primary workflow commands are given first, followed byless common or more advanced commands.Main commands:  init          Prepare your working directory for other commands  validate      Check whether the configuration is valid  plan          Show changes required by the current configuration  apply         Create or update infrastructure  destroy       Destroy previously-created infrastructureAll other commands:  console       Try Terraform expressions at an interactive command prompt  fmt           Reformat your configuration in the standard style  force-unlock  Release a stuck lock on the current workspace  get           Install or upgrade remote Terraform modules  graph         Generate a Graphviz graph of the steps in an operation  import        Associate existing infrastructure with a Terraform resource  login         Obtain and save credentials for a remote host  logout        Remove locally-stored credentials for a remote host  metadata      Metadata related commands  modules       Show all declared modules in a working directory  output        Show output values from your root module  providers     Show the providers required for this configuration  refresh       Update the state to match remote systems  show          Show the current state or a saved plan  state         Advanced state management  taint         Mark a resource instance as not fully functional  untaint       Remove the 'tainted' state from a resource instance  version       Show the current Terraform version  workspace     Workspace managementGlobal options (use these before the subcommand, if any):  -chdir=DIR    Switch to a different working directory before executing the                given subcommand.  -help         Show this help output, or the help for a specified subcommand.  -version      An alias for the "version" subcommand.

(The output from your current Terraform version may be different than theabove example.)

To get specific help for any specific command, use the-help option with therelevant subcommand. For example, to see help about the "validate" subcommandyou can runterraform validate -help.

The inline help built in to Terraform CLI describes the most importantcharacteristics of each command. For more detailed information, refer to eachcommand's page for details.

Switching working directory with-chdir

The usual way to run Terraform is to first switch to the directory containingthe.tf files for your root module (for example, using thecd command), sothat Terraform will find those files automatically without any extra arguments.

In some cases though — particularly when wrapping Terraform in automationscripts — it can be convenient to run Terraform from a different directory thanthe root module directory. To allow that, Terraform supports a global option-chdir=... which you can include before the name of the subcommand you intendto run:

terraform -chdir=environments/production apply

Thechdir option instructs Terraform to change its working directory to thegiven directory before running the given subcommand. This means that any filesthat Terraform would normally read or write in the current working directorywill be read or written in the given directory instead.

There are two exceptions where Terraform will use the original working directoryeven when you specify-chdir=...:

• Settings in theCLI Configuration are not for a specificsubcommand and Terraform processes them before acting on the-chdiroption.

• In case you need to use files from the original working directory as partof your configuration, a reference topath.cwd in the configuration willproduce the original working directory instead of the overridden workingdirectory. Usepath.root to get the root module directory.

Shell Tab-completion

If you use eitherbash orzsh as your command shell, Terraform can providetab-completion support for all command names and some command arguments.

To add the necessary commands to your shell profile, run the following command:

terraform -install-autocomplete

After installation, it is necessary to restart your shell or to re-read itsprofile script before completion will be activated.

To uninstall the completion hook, assuming that it has not been modifiedmanually in the shell profile, run the following command:

terraform -uninstall-autocomplete

Upgrade and Security Bulletin Checks

The Terraform CLI commands interact with the HashiCorp serviceCheckpoint to check for the availabilityof new versions and for critical security bulletins about the current version.

One place where the effect of this can be seen is interraform version, whereit is used by default to indicate in the output when a newer version isavailable.

Only anonymous information, which cannot be used to identify the user or host,is sent to Checkpoint. An anonymous ID is sent which helps de-duplicate warningmessages. Both the anonymous id and the use of checkpoint itself are completelyoptional and can be disabled.

Checkpoint itself can be entirely disabled for all HashiCorp products bysetting the environment variableCHECKPOINT_DISABLE to any non-empty value.

Alternatively, settings inthe CLI configuration file can be used todisable checkpoint features. The following checkpoint-related settings aresupported in this file:

• disable_checkpoint - set totrue to disable checkpoint callsentirely. This is similar to theCHECKPOINT_DISABLE environment variabledescribed above.

• disable_checkpoint_signature - set totrue to disable the use of ananonymous signature in checkpoint requests. This allows Terraform to checkfor security bulletins but does not send the anonymous signature in theserequests.

The Checkpoint client code usedby Terraform is available for review by any interested party.