Terraform Troubleshooting and Migration Cheat Sheet

export TF_LOG=TRACE

# Turn on maximum logging detail for hard-to-diagnose issues.

export TF_LOG=DEBUG && export TF_LOG_PATH=terraform-debug.log

# Capture debug logs into a file for later analysis.

terraform providers schema -json > providers-schema.json

# Dump provider schemas for automation or debugging tools.

terraform plan -detailed-exitcode

# Return 0 for no changes, 2 for changes, 1 for errors; useful in CI.

terraform 0.13upgrade

# Legacy helper command that updated provider source declarations in Terraform 0.13.

terraform init -upgrade && terraform providers lock -platform=linux_amd64 -platform=darwin_arm64

# Refresh provider selections and lock file after changing constraints.

moved {
  from = module.network.aws_subnet.private["a"]
  to   = module.vpc.aws_subnet.private["a"]
}

# Preserve state when refactoring module paths or names.

terraform state show module.vpc.aws_vpc.this

# Inspect one resource nested inside a module.

terraform state mv module.old.aws_s3_bucket.logs module.new.aws_s3_bucket.logs

# Move a tracked object between module addresses.

terraform state rm aws_instance.web[0]

# Remove a single indexed or keyed instance from state.

terraform plan -refresh-only

# Refresh state from real infrastructure without proposing config changes.

terraform apply -refresh-only -auto-approve

# Persist refreshed state after infrastructure drift detection.

terraform import aws_db_instance.main my-db-instance-id

# Rebuild Terraform state associations after state loss or partial migration.