FahamLah

Terraform & OpenTofu commands

One page per command. What it does, when to use it, how risky it is.

The loop: init, plan, apply

  • tofu initGets the providers a blueprint needs and writes the lock file.Safe
  • tofu planShows what apply would do: + create, ~ change, - destroy, -/+ replace. Changes nothing.Safe
  • tofu applyBuilds or changes real things to match the blueprint. It shows the plan and asks first.Careful
  • tofu destroyDeletes every real thing this blueprint built. It asks first.Can lose work

Check and tidy

  • tofu fmtTidies .tf files: spaces, indents and lined-up = signs. Same meaning.Safe
  • tofu validateChecks the blueprint for mistakes: typos, wrong names, missing settings.Safe
  • tofu versionPrints the OpenTofu version, and the providers this folder uses.Safe
  • tofu providers lockWrites provider checksums into the lock file, for the platforms you name.Safe
  • tofu showPrints the register, or a saved plan, in a readable way. With -json, for robots like policy and cost checks.Safe

State

  • tofu state listLists every thing in the register (the state), one address per line.Safe
  • tofu state showPrints every saved detail of one thing in the register. Sensitive values stay hidden.Safe
  • tofu state rmMakes OpenTofu forget a thing. The real thing stays, but nobody manages it any more.Careful
  • tofu state mvRenames a thing inside the register only. Nothing real changes.Careful
  • tofu importAdopts one thing that was built by hand, straight into the register, with no plan first.Careful
  • tofu planShows what changed outside OpenTofu (drift), and changes nothing.Safe
  • tofu force-unlockRemoves a stuck lock from the register, using the ID from the lock error.Careful

Workspaces and outputs

  • tofu outputPrints the outputs the blueprint shared, read from the state file.Safe
  • tofu workspace listManages extra registers for the same blueprint and backend.Careful