State & Workspaces

Inspecting and surgically editing state, managing workspaces, importing existing infrastructure, and reading outputs.

Inspecting state#

Copy
terraform state list                          # every resource instance in state
terraform state list module.vpc               # filter to one module
terraform state show aws_instance.web          # full attributes of one resource, as currently in state

Moving and removing state entries#

Copy
terraform state mv aws_instance.old aws_instance.new    # rename a resource without destroy/recreate
terraform state mv module.old_name module.new_name       # move an entire module
terraform state rm aws_instance.web                        # forget a resource without destroying it in real infra

state rm does not touch the real infrastructure — it only makes Terraform stop tracking the resource. Useful when a resource should now be managed elsewhere (a different state file, or manually), but never a way to "delete" something you actually want gone.

Workspaces#

Copy
terraform workspace list
terraform workspace new staging
terraform workspace select staging
terraform workspace select production -or-create   # switch, creating it first if it doesn't exist

Workspaces give you multiple independent state files from one configuration — useful for environment isolation (dev/staging/prod) with the same code, but each workspace still shares the same backend config and provider credentials. For genuinely separate environments with different credentials/accounts, separate root modules (not workspaces) are the more common enterprise pattern.

Importing existing infrastructure#

Copy
terraform import aws_instance.web i-0123456789abcdef0

import only populates state — it does not generate the matching .tf configuration for you. You still have to hand-write a resource block that matches the imported object's real attributes, or the next plan will show a large diff trying to reconcile your (empty/wrong) config against the imported state.

Reading outputs#

Copy
terraform output                              # all outputs
terraform output instance_ip                   # a single output's value
terraform output -json                          # machine-readable, for piping into another tool/script
terraform output -raw instance_ip                # raw string, no quotes — for shell scripting

Forcing resource replacement#

Copy
terraform apply -replace=aws_instance.web       # current recommended way to force a resource to be destroyed + recreated
terraform taint aws_instance.web                # older command, still works — marks a resource tainted for the next plan
terraform untaint aws_instance.web

-replace on plan/apply is the currently-documented approach (per official docs) for forcing replacement — taint/untaint still function in this version but are the older mechanism; prefer -replace in new scripts and runbooks.

Interactive console (for testing expressions)#

Copy
terraform console

Opens a REPL that loads current state and lets you evaluate expressions/interpolations (e.g. aws_instance.web.public_ip) before committing them to a config file — read-only, never modifies state.