Terraform Operations

Purpose: Use this file when working with state, import, drift detection, workspaces, module versioning, or backend migration.

Contents:

Command	Purpose	Risk
`terraform state list`	List state addresses	Safe
`terraform state show <addr>`	Inspect a state entry	Safe
`terraform state mv <src> <dst>`	Refactor state addresses	Medium
`terraform state rm <addr>`	Stop managing a resource	High
`terraform state pull`	Download remote state	Safe
`terraform state push`	Upload local state	High
`terraform state replace-provider`	Provider rewrite	Medium

Prefer declarative moved blocks over ad hoc terraform state mv.

moved {
  from = aws_instance.web
  to   = aws_instance.app
}

Best practice: keep moved blocks for 2-3 months after apply, then remove them.

Prefer Terraform import blocks on 1.5+:

import {
  to = aws_s3_bucket.existing
  id = "my-existing-bucket-name"
}

Approach	Use when	Recommendation
Workspaces	Same config, different state	small/simple projects
Directory-per-env	Different config per env	complex projects; recommended default
Terragrunt	Shared multi-env orchestration	large estates

terraform plan -detailed-exitcode -out=drift.tfplan
terraform plan -refresh-only
terraform apply -refresh-only

Interpretation:

Backend migration pattern:

terraform state pull > terraform.tfstate.backup
terraform init -migrate-state
terraform plan

terraform plan after migration should show no changes.

Third-party checks

1 warning13d5 checks · Risk SAFE

Gen Agent Trust Hub13d
The skill is a comprehensive infrastructure provisioning assistant that follows security best practices for IaC. It has an inherent attack surface for indirect prompt injection as it processes external requirements to generate code, and it involves the dynamic generation of infrastructure scripts.
Socket13d
No alerts
Snyk13d
Risk: LOW · No issues
Runlayer6mo
5/14 files flagged
ZeroLeaks5mo
Score: 93/100 · 2 sections analyzed

/scaffold