CLI commands: init, plan, apply, destroy, and more

Mastering the flags of each CLI command is essential for the exam. This guide covers each command with its most important options and when to use them.

Contents

terraform init
terraform plan
terraform apply and destroy
terraform fmt and validate
output, show, graph, and more

terraform init

Initializes the working directory. It must be run before any other command, after creating a new configuration or changing providers/backends.

Flag	Description	When to use it
-upgrade	Updates providers to the highest range allowed by the constraints	When you want to use newer provider versions
-reconfigure	Reconfigures the backend, ignoring the previously saved state	When you change the backend configuration
-migrate-state	Moves the existing state to the newly configured backend	When switching from a local to a remote backend (or vice versa)
-backend-config	Passes partial backend configuration as an argument or file	To avoid hardcoding credentials in the backend {} block
-backend=false	Skips backend initialization	In modules that don't have their own backend
-get=false	Skips downloading modules	When you only want to reinstall providers

# First initialization
terraform init

# Update providers to newer versions
terraform init -upgrade

# Migrate state from local to S3
terraform init -migrate-state

# Pass backend config without hardcoding it in .tf
terraform init -backend-config="bucket=my-tfstate" -backend-config="region=us-east-1"
terraform init -backend-config=backend.hcl  # from a file

terraform plan

Generates and shows the execution plan without making real changes. It's the most commonly used command day to day.

Flag	Description
-out=<file>	Saves the plan to a binary file to apply it exactly later with terraform apply <file>
-target=<resource>	Limits the plan to a specific resource (e.g.: -target=aws_vpc.main). Use with caution.
-destroy	Generates a destruction plan for all resources (equivalent to terraform destroy but plan-only)
-refresh-only	Only refreshes state against reality without planning config changes (detects drift)
-var="key=value"	Defines an inline variable. Can be repeated for multiple variables.
-var-file=<file>	Loads variables from an additional .tfvars file
-refresh=false	Skips refreshing state (faster but may not detect external manual changes)
-parallelism=N	Number of concurrent operations (default: 10)

# Normal plan
terraform plan

# Save the plan (recommended in CI/CD pipelines)
terraform plan -out=tfplan.binary

# Plan with inline variable
terraform plan -var="environment=prod" -var="instance_type=t3.large"

# Plan with a variables file
terraform plan -var-file=prod.tfvars

# Refresh-only plan (detect drift)
terraform plan -refresh-only

# Destroy plan
terraform plan -destroy

💡 -target in production

The -target flag is useful in emergencies but can leave the state inconsistent. HashiCorp recommends not using it routinely. If you need to apply only part of the config, consider structuring it into separate modules.

terraform apply and destroy

terraform apply

# Applies by generating a new plan (asks for confirmation)
terraform apply

# Applies without confirmation (CI/CD)
terraform apply -auto-approve

# Applies a saved plan (no confirmation prompt)
terraform apply tfplan.binary

# Applies only a specific resource
terraform apply -target=aws_vpc.main

# With variables
terraform apply -var="env=prod"
terraform apply -var-file=prod.tfvars

terraform destroy

# Destroys all resources (asks for confirmation)
terraform destroy

# Without confirmation (DANGEROUS in prod)
terraform destroy -auto-approve

# Destroys only one resource
terraform destroy -target=aws_instance.web

# Equivalent alternative:
terraform apply -destroy
terraform apply -destroy -auto-approve

⚠️ terraform destroy is irreversible

Destroy removes the real resources in the cloud. Before destroying in production, check the plan with terraform plan -destroy and consider using prevent_destroy = true in the lifecycle of critical resources.

terraform fmt and validate

Command	What it does	Important flags
terraform fmt	Reformats the .tf files in the current directory to the canonical HCL style (2 spaces, aligned =)	-recursive: also processes subdirectories \| -check: only checks, doesn't modify (useful in CI) \| -diff: shows the diff without applying it
terraform validate	Verifies that the configuration is syntactically valid and internally consistent (without connecting to APIs)	-json: JSON output for CI/CD

# Format all .tf files in the current directory
terraform fmt

# Format recursively (includes subdirectories / modules)
terraform fmt -recursive

# Only check formatting without modifying (for CI)
terraform fmt -check
terraform fmt -check -recursive

# Validate syntax and internal consistency
terraform validate

# Recommended combo in pre-commit hooks:
terraform fmt -check && terraform validate

💡 validate vs. plan

terraform validate checks syntax and internal references without connecting to the cloud APIs. It does not detect permission errors or invalid resource names. terraform plan does connect to the APIs and detects those errors.

output, show, graph, and more

terraform output

Shows the values of the outputs from the current state.

terraform output                    # all outputs
terraform output vpc_id             # specific output
terraform output -json              # all in JSON
terraform output -json vpc_id       # one in JSON

terraform show

Shows the current state (tfstate) or the contents of a plan file in a human-readable format.

terraform show                      # shows the current state
terraform show tfplan.binary        # shows the saved plan
terraform show -json                # state in JSON

terraform graph

Generates the dependency graph in DOT format (viewable with Graphviz).

terraform graph                     # generates DOT to stdout
terraform graph | dot -Tsvg > infra.svg  # visualize

terraform force-unlock

Manually releases a state lock that got stuck (e.g.: an interrupted apply). Requires the lock ID.

terraform force-unlock LOCK_ID

terraform login / logout

Authenticates with HCP Terraform (app.terraform.io) to access remote workspaces.

terraform login                     # opens a browser to authenticate
terraform logout                    # removes the local token

terraform console

Interactive REPL for evaluating HCL expressions. Useful for debugging functions and references.

terraform console
> max(3, 5, 8)
8
> jsonencode({a = "b"})
"{\"a\":\"b\"}"

Did you get this topic?

Test what you just learned

A team uses a CI/CD pipeline with two stages: the first generates the plan and the second applies it. Which command sequence guarantees that exactly the reviewed plan is the one applied?

Ready to test "CLI Commands: init, plan, apply, destroy and More"?

Put what you learned to the test with original Terraform Associate exam questions.

Start Terraform Associate mock exam

Unlimited mock exams with the Pro plan

PreviousThe Write → Plan → Apply CycleCore Workflow NextProviders: Plugin Architecture and ConfigurationProviders and Configuration