CheatOpenTofu Open-source infrastructure as code
Light · Postcard
102 × 152 mm · PDF
Dark · Postcard
102 × 152 mm · PDF
Ink saver · Postcard
102 × 152 mm · PDF
Light · A4 landscape
297 × 210 mm · PDF
Dark · A4 landscape
297 × 210 mm · PDF
Ink saver · A4 landscape
297 × 210 mm · PDF
Light · A3 landscape
420 × 297 mm · PDF
Dark · A3 landscape
420 × 297 mm · PDF
Ink saver · A3 landscape
420 × 297 mm · PDF
Start here
tofu initDownload providers and modules
tofu fmtFormat the files
tofu validateCheck the configuration
tofu plan -out=<file>
Preview and save changes
tofu apply <file>
Apply the saved plan
tofu outputShow output values
tofu state listList tracked resources
tofu destroyRemove everything managed
Concepts
- Config .tf files
- Working dir providers, modules
- Plan diff vs. state
- Infrastructure state updated
Workflow
tofu initPrepare the working directory
Run again after adding a provider, module or backend.
tofu init -upgrade
Update providers and modules
tofu init -reconfigure
Ignore saved backend setup
tofu init -migrate-state
Move state to a new backend
tofu validateCheck configuration syntax
tofu planPreview changes
tofu plan -out=<file>
Save the plan to a file
tofu applyCreate or update infrastructure
tofu apply <planfile>
Apply a saved plan
tofu apply -auto-approve
Skip the confirmation prompt
tofu destroyRemove all managed resources
tofu plan -destroy
Preview a destroy
tofu plan -refresh-only
Preview drift against reality
tofu fmtFormat files in place
tofu fmt -recursive -check
Check formatting in CI
Targeting & plans
tofu plan -target=<addr>
Limit to one resource
tofu plan -exclude=<addr>
Skip a resource and its dependents
Documented for exceptional cases only.
tofu apply -replace=<addr>
Force recreating a resource
tofu plan -refresh=false
Skip refreshing real state
tofu plan -parallelism=<n>
Limit concurrent operations
tofu plan -detailed-exitcode
Exit 2 when changes exist
tofu plan -generate-config-out=<file>
Draft HCL for import blocks
Experimental; the file must not exist yet.
tofu show <planfile>
Read a saved plan
tofu show -json <planfile>
Plan as JSON
tofu graphEmit a Graphviz dependency graph
Variables & outputs
tofu plan -var '<name>=<value>'
Set one variable
tofu plan -var-file=<file>
Load variables from a file
TF_VAR_<name>=<value>
Set a variable via environment
terraform.tfvars
Auto-loaded variable file
tofu outputShow all outputs
tofu output <name>
Show one output
tofu output -raw <name>
Plain value for scripts
tofu output -json
All outputs as JSON
tofu consoleTry expressions interactively
State
tofu state listList tracked resources
tofu state show <addr>
Show one resource's attributes
tofu state mv <src> <dst>
Rename or move in state
tofu state rm <addr>
Forget a resource, keep the real one
tofu state pullPrint remote state as JSON
tofu state push <file>
Overwrite state from a file
tofu import <addr> <id>
Adopt an existing resource
tofu taint <addr>
Mark for recreation
tofu untaint <addr>
Clear the taint mark
tofu force-unlock <id>
Release a stuck state lock
tofu refreshSync state with reality
Workspaces
tofu workspace list
List workspaces
tofu workspace show
Show the current workspace
tofu workspace new <name>
Create and switch
tofu workspace select <name>
Switch workspace
tofu workspace delete <name>
Delete an empty workspace
Testing & modules
tofu testRun *.tftest.hcl test files
Creates real infrastructure, then destroys it.
tofu test -filter=<file>
Run one test file
tofu test -verbose
Print plan or state per run
tofu test -test-directory=<dir>
Use another test folder
tofu providersShow required providers
tofu getFetch remote modules
tofu metadata functions -json
List built-in functions
tofu loginStore credentials for a registry host
tofu versionShow the OpenTofu version
tofu -chdir=<dir> <cmd>
Run in another directory
Recipes
tofu inittofu fmt -check && tofu validatetofu plan -out=tfplantofu show tfplantofu apply tfplantofu workspace select prodtofu plan -var-file=prod.tfvars -out=prod.plantofu apply prod.plantofu state mv aws_instance.old aws_instance.newtofu plan # expect no changestofu plan -replace=aws_instance.web -out=fix.plantofu apply fix.plan
