Core Workflow

The everyday loop: initialize, validate, plan, apply, destroy — plus formatting and variable input.

Initializing a working directory#

Copy
terraform init
terraform init -upgrade                 # also upgrade provider/module versions to the latest allowed
terraform init -backend=false           # skip remote backend setup (e.g. for a quick local validate)

init is always safe to re-run — it never deletes configuration or state. Run it any time you add a new provider, module, or change the backend block.

Validating configuration#

Copy
terraform validate
terraform validate -json                # machine-readable output, useful in CI
terraform fmt                            # rewrite files to canonical formatting
terraform fmt -check                     # exit non-zero if formatting would change (CI check, no rewrite)
terraform fmt -recursive                 # format all subdirectories too

validate only checks syntax and internal consistency — it does not contact providers or check whether your credentials/values would actually work against real infrastructure. That's what plan is for.

Planning changes#

Copy
terraform plan
terraform plan -out=tfplan               # save the plan to a file for a later, exact apply
terraform plan -var="instance_count=3"
terraform plan -var-file="prod.tfvars"
terraform plan -target=aws_instance.web  # limit planning to one resource/module (use sparingly)
terraform plan -destroy                  # preview what a destroy would do, without doing it

-target is a scalpel for a specific fix or debugging session, not a routine workflow — repeatedly targeting individual resources instead of planning the whole configuration can let real drift between your state and the full config go unnoticed.

Applying changes#

Copy
terraform apply
terraform apply tfplan                   # apply an exact, previously-saved plan — no new plan, no prompt
terraform apply -auto-approve            # skip the interactive yes/no prompt (CI pipelines)
terraform apply -var="instance_count=3"

Applying a saved plan file (terraform apply tfplan) is the safer pattern for CI/CD — it guarantees the infrastructure change applied is exactly what was reviewed in the plan step, with no window for the underlying config or state to drift between plan and apply.

Destroying infrastructure#

Copy
terraform destroy
terraform destroy -target=aws_instance.web   # destroy a single resource
terraform destroy -auto-approve

destroy is a convenience alias for apply -destroy — same safety considerations apply: no undo, and CI usage should require explicit human approval unless the environment is genuinely disposable (e.g. ephemeral PR preview environments).