OpenTofu

Open-source Terraform alternative for infrastructure as code. Community-driven, backward-compatible, and truly open.

58 commands

Browse by Topic

Getting Started

Quick setup and installation

3commands

Initialization

Initialize config

8commands

Planning

Preview changes

9commands

Applying

Apply changes

9commands

State

State management

9commands

Encryption

State encryption

4commands

Workspaces

Workspace management

5commands

Output & Utils

Output, format, validate

11commands

Install OpenTofu (macOS)

$ brew install opentofu

Install OpenTofu using Homebrew on macOS

Check OpenTofu version

$ tofu --version

Display the installed OpenTofu version

Initialize a new project

$ tofu init

Initialize a new OpenTofu working directory with providers

Initialize

$ tofu init

Initialize OpenTofu configuration.

Upgrade providers

$ tofu init -upgrade

Upgrade providers and modules.

Reconfigure backend

$ tofu init -reconfigure

Reconfigure backend settings.

Migrate state

$ tofu init -migrate-state

Migrate state to new backend.

Backend config file

$ tofu init -backend-config=backend.hcl

Initialize with external backend config file.

Backend config variable

$ tofu init -backend-config='bucket=my-state-bucket'

Pass individual backend config key-value pair.

Plugin cache directory

$ TF_PLUGIN_CACHE_DIR=~/.tofu.d/plugin-cache tofu init

Use local plugin cache to speed up init.

Lock provider versions

$ tofu providers lock -platform=linux_amd64 -platform=darwin_amd64

Generate lock file for multiple platforms.

Create plan

$ tofu plan

Show planned changes.

Save plan

$ tofu plan -out=tfplan

Save plan to file.

Plan with variables

$ tofu plan -var 'region=us-west-2'

Plan with variable override.

Destroy plan

$ tofu plan -destroy

Plan resource destruction.

Plan with var file

$ tofu plan -var-file=prod.tfvars

Plan using a variables file.

Target specific resource

$ tofu plan -target=aws_instance.web

Plan changes for a specific resource only.

Replace resource

$ tofu plan -replace=aws_instance.web

Plan to force-replace a specific resource.

Refresh-only plan

$ tofu plan -refresh-only

Plan to update state without changing resources.

Generate import config

$ tofu plan -generate-config-out=generated.tf

Generate config for imported resources.

Apply changes

$ tofu apply

Apply infrastructure changes.

Apply saved plan

$ tofu apply tfplan

Apply from saved plan file.

Auto-approve

$ tofu apply -auto-approve

Apply without confirmation.

Destroy resources

$ tofu destroy

Destroy all resources.

Target specific resource

$ tofu apply -target=aws_instance.web

Apply to specific resource.

Set parallelism

$ tofu apply -parallelism=20

Apply with custom parallelism limit.

Replace resource

$ tofu apply -replace=aws_instance.web

Force-replace a specific resource.

Refresh-only apply

$ tofu apply -refresh-only -auto-approve

Update state to match real resources.

Destroy auto-approve

$ tofu destroy -auto-approve

Destroy all resources without confirmation.

List state

$ tofu state list

List resources in state.

Show resource

$ tofu state show aws_instance.web

Show resource details.

Move resource

$ tofu state mv aws_instance.old aws_instance.new

Rename resource in state.

Import resource

$ tofu import aws_instance.web i-1234567890

Import existing resource.

Remove from state

$ tofu state rm aws_instance.web

Remove resource from state.

Pull remote state

$ tofu state pull

Download and output remote state.

Push state

$ tofu state push errored.tfstate

Upload a local state file to remote backend.

Force unlock state

$ tofu force-unlock LOCK_ID

Manually unlock a stuck state lock.

Replace provider

$ tofu state replace-provider hashicorp/aws registry.opentofu.org/hashicorp/aws

Replace provider source in state.

Enable encryption

$ terraform { encryption { key_provider "pbkdf2" "my_passphrase" { passphrase = var.passphrase } method "aes_gcm" "my_method" { keys = key_provider.pbkdf2.my_passphrase } state { method = method.aes_gcm.my_method } } }

Configure state encryption.

AWS KMS encryption

$ key_provider "aws_kms" "my_kms" { kms_key_id = "alias/my-key" region = "us-east-1" }

Use AWS KMS for encryption.

GCP KMS encryption

$ key_provider "gcp_kms" "my_gcp" { kms_encryption_key = "projects/my-proj/locations/global/keyRings/my-ring/cryptoKeys/my-key" }

Use Google Cloud KMS for state encryption.

Plan file encryption

$ encryption { plan { method = method.aes_gcm.my_method } }

Encrypt plan files alongside state.

List workspaces

$ tofu workspace list

List all available workspaces.

Create workspace

$ tofu workspace new staging

Create a new workspace.

Select workspace

$ tofu workspace select production

Switch to an existing workspace.

Show current workspace

$ tofu workspace show

Display the current workspace name.

Delete workspace

$ tofu workspace delete staging

Delete an existing workspace.

List all outputs

$ tofu output

Show all output values from state.

Get specific output

$ tofu output instance_ip

Show a single output value.

Output as JSON

$ tofu output -json

Show all outputs in JSON format.

Raw output value

$ tofu output -raw instance_ip

Show raw value without quotes or formatting.

Format files

$ tofu fmt

Format all .tf files in current directory.

Format recursively

$ tofu fmt -recursive

Format .tf files in all subdirectories.

Check formatting

$ tofu fmt -check

Check if files are formatted without modifying.

Validate config

$ tofu validate

Validate configuration syntax and consistency.

Dependency graph

$ tofu graph | dot -Tpng > graph.png

Generate visual dependency graph.

List providers

$ tofu providers

Show providers required by configuration.

Show version

$ tofu version

Display OpenTofu and provider versions.

Discussion

Loading comments...

OpenTofu

Open-source Terraform alternative for infrastructure as code. Community-driven, backward-compatible, and truly open.

58 commands

Browse by Topic

Getting Started

Quick setup and installation

3commands

Initialization

Initialize config

8commands

Planning

Preview changes

9commands

Applying

Apply changes

9commands

State

State management

9commands

Encryption

State encryption

4commands

Workspaces

Workspace management

5commands

Output & Utils

Output, format, validate

11commands

Install OpenTofu (macOS)

$ brew install opentofu

Install OpenTofu using Homebrew on macOS

Check OpenTofu version

$ tofu --version

Display the installed OpenTofu version

Initialize a new project

$ tofu init

Initialize a new OpenTofu working directory with providers

Initialize

$ tofu init

Initialize OpenTofu configuration.

Upgrade providers

$ tofu init -upgrade

Upgrade providers and modules.

Reconfigure backend

$ tofu init -reconfigure

Reconfigure backend settings.

Migrate state

$ tofu init -migrate-state

Migrate state to new backend.

Backend config file

$ tofu init -backend-config=backend.hcl

Initialize with external backend config file.

Backend config variable

$ tofu init -backend-config='bucket=my-state-bucket'

Pass individual backend config key-value pair.

Plugin cache directory

$ TF_PLUGIN_CACHE_DIR=~/.tofu.d/plugin-cache tofu init

Use local plugin cache to speed up init.

Lock provider versions

$ tofu providers lock -platform=linux_amd64 -platform=darwin_amd64

Generate lock file for multiple platforms.

Create plan

$ tofu plan

Show planned changes.

Save plan

$ tofu plan -out=tfplan

Save plan to file.

Plan with variables

$ tofu plan -var 'region=us-west-2'

Plan with variable override.

Destroy plan

$ tofu plan -destroy

Plan resource destruction.

Plan with var file

$ tofu plan -var-file=prod.tfvars

Plan using a variables file.

Target specific resource

$ tofu plan -target=aws_instance.web

Plan changes for a specific resource only.

Replace resource

$ tofu plan -replace=aws_instance.web

Plan to force-replace a specific resource.

Refresh-only plan

$ tofu plan -refresh-only

Plan to update state without changing resources.

Generate import config

$ tofu plan -generate-config-out=generated.tf

Generate config for imported resources.

Apply changes

$ tofu apply

Apply infrastructure changes.

Apply saved plan

$ tofu apply tfplan

Apply from saved plan file.

Auto-approve

$ tofu apply -auto-approve

Apply without confirmation.

Destroy resources

$ tofu destroy

Destroy all resources.

Target specific resource

$ tofu apply -target=aws_instance.web

Apply to specific resource.

Set parallelism

$ tofu apply -parallelism=20

Apply with custom parallelism limit.

Replace resource

$ tofu apply -replace=aws_instance.web

Force-replace a specific resource.

Refresh-only apply

$ tofu apply -refresh-only -auto-approve

Update state to match real resources.

Destroy auto-approve

$ tofu destroy -auto-approve

Destroy all resources without confirmation.

List state

$ tofu state list

List resources in state.

Show resource

$ tofu state show aws_instance.web

Show resource details.

Move resource

$ tofu state mv aws_instance.old aws_instance.new

Rename resource in state.

Import resource

$ tofu import aws_instance.web i-1234567890

Import existing resource.

Remove from state

$ tofu state rm aws_instance.web

Remove resource from state.

Pull remote state

$ tofu state pull

Download and output remote state.

Push state

$ tofu state push errored.tfstate

Upload a local state file to remote backend.

Force unlock state

$ tofu force-unlock LOCK_ID

Manually unlock a stuck state lock.

Replace provider

$ tofu state replace-provider hashicorp/aws registry.opentofu.org/hashicorp/aws

Replace provider source in state.

Enable encryption

Configure state encryption.

AWS KMS encryption

$ key_provider "aws_kms" "my_kms" { kms_key_id = "alias/my-key" region = "us-east-1" }

Use AWS KMS for encryption.

GCP KMS encryption

$ key_provider "gcp_kms" "my_gcp" { kms_encryption_key = "projects/my-proj/locations/global/keyRings/my-ring/cryptoKeys/my-key" }

Use Google Cloud KMS for state encryption.

Plan file encryption

$ encryption { plan { method = method.aes_gcm.my_method } }

Encrypt plan files alongside state.

List workspaces

$ tofu workspace list

List all available workspaces.

Create workspace

$ tofu workspace new staging

Create a new workspace.

Select workspace

$ tofu workspace select production

Switch to an existing workspace.

Show current workspace

$ tofu workspace show

Display the current workspace name.

Delete workspace

$ tofu workspace delete staging

Delete an existing workspace.

List all outputs

$ tofu output

Show all output values from state.

Get specific output

$ tofu output instance_ip

Show a single output value.

Output as JSON

$ tofu output -json

Show all outputs in JSON format.

Raw output value

$ tofu output -raw instance_ip

Show raw value without quotes or formatting.

Format files

$ tofu fmt

Format all .tf files in current directory.

Format recursively

$ tofu fmt -recursive

Format .tf files in all subdirectories.

Check formatting

$ tofu fmt -check

Check if files are formatted without modifying.

Validate config

$ tofu validate

Validate configuration syntax and consistency.

Dependency graph

$ tofu graph | dot -Tpng > graph.png

Generate visual dependency graph.

List providers

$ tofu providers

Show providers required by configuration.

Show version

$ tofu version

Display OpenTofu and provider versions.

Discussion

Loading comments...