Installing and Configuring Terraform CLI
1. Installing Terraform
| Method | Description | Notes |
|---|---|---|
| Official Binary | Download pre-compiled binaries from the official Terraform website. | Available for Linux, macOS, Windows. Requires manual setup and PATH configuration. |
| Package Managers | Use system package managers like Homebrew (macOS), APT (Linux), or Chocolatey (Windows). | Automatically handles versioning and PATH. May not always have the latest release. |
| Terraform Version Manager (tfenv) | Version manager similar to rbenv or nvm, supports multiple Terraform versions. | Allows switching between versions easily. Requires installation of tfenv itself. |
| IDE Integration | Some IDEs (e.g., VS Code with HashiCorp Terraform extension) provide built-in support. | May include auto-installation or version selection features. Not a standalone installer. |
Example: Installing Terraform via Official Binary (Linux)
curl -O https://releases.hashicorp.com/terraform/1.9.5/terraform_1.9.5_linux_amd64.zip
unzip terraform_1.9.5_linux_amd64.zip
sudo mv terraform /usr/local/bin/
terraform version
terraform binary is executable and located in your system's PATH for command-line usage.
2. Verifying Installation
| Command | Description | Expected Output |
|---|---|---|
| terraform version | Displays the installed Terraform version | Terraform v1.9.5 on darwin_arm64 |
| terraform --version | Alternative syntax for displaying version | Terraform v1.9.5 on darwin_arm64 |
3. Enabling Tab Completion
Terraform supports tab completion for the CLI in Bash and Zsh shells, enhancing productivity by auto-completing commands, flags, and resource names.
| Shell | Setup Command | Notes |
|---|---|---|
| Bash | terraform -install-autocomplete |
Installs the completion script to ~/.bash_completion |
| Zsh | terraform -install-autocomplete |
Installs the completion script to ~/.zshrc |
4. Configuring CLI Settings
| Setting | Description | Default Value | Configuration Method |
|---|---|---|---|
| cli.config | Path to the CLI configuration file | ~/.terraformrc |
Environment variable TERRAFORM_CONFIG or CLI flag -config |
| plugin.cache | Enables caching of downloaded plugins | true |
Set in .terraformrc or via CLI flag -plugin-dir |
| auto-approve | Skips interactive approval for plan execution | false |
CLI flag -auto-approve |
| parallelism | Maximum number of concurrent operations | 10 |
CLI flag -parallelism=N |
auto-approve to true bypasses interactive checks and should be used carefully.
5. Setting Up Credentials
Terraform uses various providers to interact with cloud services and external systems. Each provider requires appropriate credentials to authenticate and authorize operations.
| Provider | Credential Method | Configuration Example | Notes |
|---|---|---|---|
| AWS | credentials |
{"access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"} |
Use IAM roles for EC2 instances or environment variables |
| Azure | service_principal |
{"subscription_id": "12345678-1234-1234-1234-123456789012", "client_id": "abcd1234-efgh-5678-ijkl-9012mnop3456", "client_secret": "secret-key", "tenant_id": "tenant-id"} |
Requires Azure AD application registration |
| Google Cloud | service_account_key |
{"project": "my-project", "private_key_id": "key-id", "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----", "client_email": "service-account@my-project.iam.gserviceaccount.com"} |
Use service account keys or ADC (Application Default Credentials) |
| GitHub | token |
{"token": "ghp_abc123..."} |
Personal Access Token (PAT) with appropriate scopes |
Example: AWS Provider Configuration
provider "aws" {
region = "us-west-2"
access_key = "AKIAIOSFODNN7EXAMPLE"
secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
6. Configuring Plugin Cache
Terraform uses a plugin cache to store downloaded provider plugins locally. By default, Terraform stores these in the ~/.terraform.d/plugins directory.
| Configuration Option | Values | Description |
|---|---|---|
| plugin_cache_dir | ~/.terraform.d/plugins |
Directory where Terraform stores downloaded plugins |
plugin_cache_dir setting in the terraform block of your Terraform configuration file or via environment variable TERRAFORM_PLUGIN_CACHE_DIR.
7. Setting Environment Variables
| Variable | Description | Default Value | Notes |
|---|---|---|---|
| TF_LOG | Enables logging for Terraform operations | OFF | Set to DEBUG, INFO, WARN, or ERROR |
| TF_LOG_PATH | Specifies the file path for Terraform logs | stdout | Must be a valid file path; logs are written in JSON format |
| TF_CLI_CONFIG_FILE | Path to the CLI configuration file | ~/.terraformrc |
Can be set to any valid file path for custom config |
| TF_PLUGIN_CACHE_DIR | Directory to cache downloaded plugins | ~/.terraform.d/plugin-cache |
Improves performance by caching plugins locally |
TF_LOG=DEBUG can produce large log files and should be used only when troubleshooting.
8. Using Terraform Wrapper Tools
Terraform wrapper tools help manage versions, plugins, and configurations more efficiently. These tools simplify installation, version control, and environment setup.
| Tool | Description | Key Features | Notes |
|---|---|---|---|
| tfenv | Version manager for Terraform, similar to rbenv or nvm. |
|
Popular choice for developers managing multiple Terraform versions |
| tfswitch | CLI tool to switch between Terraform versions. |
|
Lightweight alternative to tfenv |
| asdf | Generic version manager that supports Terraform via the terraform plugin. |
|
Good for environments with multiple tools (e.g., Node.js, Python, Terraform) |
Example: Using tfenv to manage Terraform versions
tfenv install 1.9.5
tfenv use 1.9.5
terraform version
9. Configuring Credential Helpers
Terraform supports credential helpers to securely manage authentication with cloud providers and other services. These helpers can store and retrieve credentials without exposing them in plain text.
| Helper | Description | Supported Providers | Installation |
|---|---|---|---|
| aws | Manages AWS credentials using the AWS CLI credential helper. | AWS | aws configure |
| gcp | Manages GCP credentials using the gcloud CLI credential helper. | GCP | gcloud auth application-default login |
| azure | Manages Azure credentials using the Azure CLI credential helper. | Azure | az login |
10. Setting Provider Installation Methods
| Method | Description | Configuration | Notes |
|---|---|---|---|
| automatic | Allows Terraform to automatically download and install providers | "automatic": true |
Default behavior in Terraform 0.13+ |
| local | Use locally installed providers (e.g., from a local directory) | "local": true |
Useful for development or custom provider builds |
| versioned | Explicitly specify provider versions in configuration | "version": ">= 1.0.0" |
Recommended for production environments |
Example: Automatic Provider Installation
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
}
}
provider "aws" {
region = "us-west-2"
}
terraform init command to download providers.
version = "*" can lead to unexpected behavior in production environments.