terraform stateInspect and repair Terraform's state
terraform state lets you look inside the state file (list, show, pull) and change how code maps to real objects without touching them (mv, rm, plus import). It's how you rename resources, split code into modules, adopt existing infrastructure, or stop managing something.
terraform state (list [ADDR] | show ADDR | mv SRC DST | rm ADDR | pull | push FILE | replace-provider) [-dry-run] · terraform import ADDR IDYou've inherited a repo and want to know what this state tracks and what Terraform recorded for one resource.
terraformThe Terraform CLI.
State is a JSON document (format version 4) holding, for every resource instance, its address (module path, type, name, count index or for_each key), the provider that manages it, its real ID and all attributes as last seen, plus outputs, a serial number and a lineage ID. It's how Terraform knows that aws_instance.web is i-0a1b2c3d4e5f67890. state list and show read it; pull prints the raw JSON. mv, rm and push modify it: Terraform takes the state lock, writes a new version with serial+1 (and, for a local backend, a .backup file) and releases the lock. They never change the real resources. rm makes Terraform forget an object (it keeps existing in AWS); import, or an import block, does the reverse, asking the provider to read an existing object by ID and adding it to state. Modern code prefers moved, removed and import blocks, which do the same through a normal reviewed plan. State contains secrets in plain text, so the backend must be encrypted and access-controlled.
list [ADDR]All resource addresses, or those under a prefixshow ADDRAll attributes of one resource instancemv SRC DSTChange an object's address (rename, into a module)rm ADDRForget an object; it keeps running in the cloudpull / pushPrint the raw state JSON / overwrite remote state (dangerous)-dry-runFor mv and rm: show what would happenimport ADDR IDAdopt an existing object (or use an import block)list -id=IDFind which address holds a given real IDreplace-providerPoint resources at a different provider sourceEditing terraform.tfstate by hand or with sedOne bad edit corrupts IDs or dependencies, and with a remote backend you also bypass locking and serial checks.
Use state mv / rm / import, or moved / removed / import blocksterraform state rm to 'fix' a resource Terraform keeps trying to changeIt stops managing the object, but the block is still in code, so the next plan creates a duplicate.
Fix the code (or ignore_changes for that attribute); rm only when handing the object to another stateRunning state mv on prod without -dry-run or a backupA wrong destination address makes the next plan destroy and recreate real resources.
terraform state pull > backup.json; state mv -dry-run; state mv; terraform plan shows no changesCommitting terraform.tfstate to GitIt contains passwords, keys and private IPs in plain text, and Git merges of state break it.
Remote encrypted backend (S3 with encryption, versioning and locking)Try these on a Linux machine of your own. Each task has a hint and a solution.
In ~/infra (after apply), list only the resources inside module.network, then show the subnet with for_each key "b" (quote it correctly).
In ~/infra (after apply), rename aws_security_group.web to aws_security_group.web_sg in state, safely. What does the next plan say, and why?
State is JSON, and so is a lot of IaC tooling output. In the sandbox, pretty-print and query a JSON file from ~/data with python3 (or jq if present).
terraform stateInspect and repair Terraform's state
terraform state lets you look inside the state file (list, show, pull) and change how code maps to real objects without touching them (mv, rm, plus import). It's how you rename resources, split code into modules, adopt existing infrastructure, or stop managing something.
terraform state (list [ADDR] | show ADDR | mv SRC DST | rm ADDR | pull | push FILE | replace-provider) [-dry-run] · terraform import ADDR IDYou've inherited a repo and want to know what this state tracks and what Terraform recorded for one resource.
terraformThe Terraform CLI.
State is a JSON document (format version 4) holding, for every resource instance, its address (module path, type, name, count index or for_each key), the provider that manages it, its real ID and all attributes as last seen, plus outputs, a serial number and a lineage ID. It's how Terraform knows that aws_instance.web is i-0a1b2c3d4e5f67890. state list and show read it; pull prints the raw JSON. mv, rm and push modify it: Terraform takes the state lock, writes a new version with serial+1 (and, for a local backend, a .backup file) and releases the lock. They never change the real resources. rm makes Terraform forget an object (it keeps existing in AWS); import, or an import block, does the reverse, asking the provider to read an existing object by ID and adding it to state. Modern code prefers moved, removed and import blocks, which do the same through a normal reviewed plan. State contains secrets in plain text, so the backend must be encrypted and access-controlled.
list [ADDR]All resource addresses, or those under a prefixshow ADDRAll attributes of one resource instancemv SRC DSTChange an object's address (rename, into a module)rm ADDRForget an object; it keeps running in the cloudpull / pushPrint the raw state JSON / overwrite remote state (dangerous)-dry-runFor mv and rm: show what would happenimport ADDR IDAdopt an existing object (or use an import block)list -id=IDFind which address holds a given real IDreplace-providerPoint resources at a different provider sourceEditing terraform.tfstate by hand or with sedOne bad edit corrupts IDs or dependencies, and with a remote backend you also bypass locking and serial checks.
Use state mv / rm / import, or moved / removed / import blocksterraform state rm to 'fix' a resource Terraform keeps trying to changeIt stops managing the object, but the block is still in code, so the next plan creates a duplicate.
Fix the code (or ignore_changes for that attribute); rm only when handing the object to another stateRunning state mv on prod without -dry-run or a backupA wrong destination address makes the next plan destroy and recreate real resources.
terraform state pull > backup.json; state mv -dry-run; state mv; terraform plan shows no changesCommitting terraform.tfstate to GitIt contains passwords, keys and private IPs in plain text, and Git merges of state break it.
Remote encrypted backend (S3 with encryption, versioning and locking)Try these on a Linux machine of your own. Each task has a hint and a solution.
In ~/infra (after apply), list only the resources inside module.network, then show the subnet with for_each key "b" (quote it correctly).
In ~/infra (after apply), rename aws_security_group.web to aws_security_group.web_sg in state, safely. What does the next plan say, and why?
State is JSON, and so is a lot of IaC tooling output. In the sandbox, pretty-print and query a JSON file from ~/data with python3 (or jq if present).