Maintain Infrastructure with Terraform · Topic 2 of 2

Inspecting State and Verbose Logging

Terraform Associate 004: inspect state with terraform state list, state show, show and output, and enable verbose logs with TF_LOG and TF_LOG_PATH.

4 min

In a nutshell

terraform state list lists addresses; terraform state show ADDRESS shows one resource's attributes.
terraform show prints the current state, or a saved plan when given a plan file; -json gives machine readable output.
terraform output redacts sensitive values in the full list but not with a NAME, -json or -raw.

What it is

Terraform state is a JSON file, but you should never read or edit it by hand. The CLI gives read commands that show what state holds: which resources exist, their attributes and the outputs the configuration exports.

Verbose logging is the next step when the normal output is not enough. Setting the TF_LOG environment variable makes Terraform print detailed internal logs, including the calls providers make to remote APIs.

How it works

Commands that inspect state

Command	What it shows
`terraform state list`	Every resource address in state, one per line
`terraform state show ADDRESS`	All recorded attributes of one resource instance
`terraform show`	The whole current state in readable form
`terraform show FILE`	A saved plan file in readable form
`terraform output`	The root module output values
`terraform state pull`	The raw state as JSON, printed to stdout

terraform state list
terraform state list module.network
terraform state show 'aws_instance.web[0]'
terraform show -json

terraform state list accepts an address to filter the list, such as a module or resource type. Addresses with brackets need quotes in most shells.

terraform output in detail

Form	Result
`terraform output`	All root outputs; sensitive ones appear as `<sensitive>`
`terraform output NAME`	That one output's value, not redacted
`terraform output -json`	All outputs as JSON, sensitive values in plain text
`terraform output -raw NAME`	One string value with no quotes, for scripts

Only root module outputs appear. A child module's outputs are visible only if the root module passes them on through its own output blocks.

Read commands versus state changing commands

The inspection commands above only read state. The terraform state group also has commands that change state, and the exam may mix them in options.

Reads state	Changes state
`terraform state list`	`terraform state mv`
`terraform state show`	`terraform state rm`
`terraform state pull`	`terraform state push`
`terraform show`, `terraform output`	`terraform import`

Where a block exists for the job, prefer moved, removed and import blocks over these commands, because the blocks go through a reviewed plan.

Turning on verbose logging

Set TF_LOG to a level before running a command. Logs go to stderr unless you set TF_LOG_PATH.

export TF_LOG=DEBUG
export TF_LOG_PATH=./terraform.log
terraform apply
unset TF_LOG TF_LOG_PATH

Variable	Purpose
`TF_LOG`	Enables logging at a level: TRACE, DEBUG, INFO, WARN or ERROR
`TF_LOG` set to JSON	Logs at TRACE level in JSON encoding, which is not a stable interface
`TF_LOG_PATH`	Appends logs to that file; needs `TF_LOG` set or nothing is logged
`TF_LOG_CORE`	Enables logs for Terraform itself only
`TF_LOG_PROVIDER`	Enables logs for provider plugins only

The levels run from most to least detailed: TRACE, DEBUG, INFO, WARN, ERROR. TRACE is the most verbose and is what bug reports usually ask for.

When to use verbose logging

Use logs when the error message does not explain the problem. Typical cases are a provider returning an unclear API error, authentication failing, a plan that hangs, or a suspected bug in Terraform or a provider that you want to report.

TF_LOG_PROVIDER helps when the problem is clearly in the provider's API calls, while TF_LOG_CORE isolates Terraform's own graph and planning logic. Turn logging off again afterwards, because detailed logs are large and noisy.

How the exam asks about this

"You need the attributes Terraform recorded for one VM." Run terraform state show with the resource address.
"Logs should go to a file for a support ticket." Set TF_LOG to a level and TF_LOG_PATH to the file.
"Which log level is the most verbose?" TRACE.

What to remember for the exam

terraform state list lists addresses; terraform state show ADDRESS shows one resource's attributes.
terraform show prints the current state, or a saved plan when given a plan file; -json gives machine readable output.
terraform output redacts sensitive values in the full list but not with a NAME, -json or -raw.
TF_LOG turns logging on; levels are TRACE, DEBUG, INFO, WARN and ERROR, and JSON means TRACE in JSON.
TF_LOG_PATH writes logs to a file but only when TF_LOG is also set.
TF_LOG_CORE and TF_LOG_PROVIDER split logs between Terraform itself and provider plugins.

Watch out

Detailed logs and raw state can contain secrets in plain text. Check a log file before attaching it to a public issue, and never edit the state file by hand.

Common mistakes

Setting TF_LOG_PATH alone. Without TF_LOG, no logs are produced, so the file stays empty. Set both variables.

Reaching for terraform show to list addresses. terraform show prints full resource details. For a quick list of addresses, terraform state list is the command.

Assuming terraform output always hides sensitive values. Only the full listing shows <sensitive>. Asking for one output by name, or using -json or -raw, prints the real value.

Check yourself

Which command shows every attribute Terraform stored for aws_instance.web?
terraform state show aws_instance.web, which prints the recorded attributes of that one resource instance.
What happens if you set TF_LOG_PATH but not TF_LOG?
Nothing is logged. TF_LOG must be set to enable logging, and TF_LOG_PATH only chooses the file.
How do you get logs from provider plugins only?
Set TF_LOG_PROVIDER to a log level, which enables logging for providers without Terraform core logs.

Topic 2 of 2 in Maintain Infrastructure with Terraform

Test yourself on Maintain Infrastructure with Terraform

The full HashiCorp Terraform Associate 004 question bank has 600 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by HashiCorp. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.