Operational Commands: terraform show, state list & the Inspection Toolkit

Terraform Is Also an Inspection Tool

Most tutorials obsess over the write-plan-apply cycle. Fair enough — that’s the main loop. But there’s a whole set of commands that are purely for reading — understanding what Terraform thinks is deployed, what state looks like, what outputs are available.

These are the commands you reach for when something seems off. When a plan shows unexpected changes. When someone asks “what’s actually deployed right now?” When you’re trying to figure out why a resource is in state that you swear you deleted.

terraform show — What’s in State (or a Plan)

# Show all resources in current state (human-readable)
terraform show

# Show a saved plan file
terraform show myplan.tfplan

# Show state in machine-readable JSON
terraform show -json | jq '.values.root_module.resources[] | {type, name: .address}'

This dumps every attribute of every managed resource — IDs, IPs, ARNs, config values, computed values. Everything Terraform knows about your infrastructure.

Use it to answer: “what does Terraform think is deployed right now?” Note the emphasis — this shows what’s in state, not necessarily what’s actually running in the cloud. If someone made changes outside Terraform, state will be stale until you refresh.

terraform state list — Inventory of Managed Resources

# List all resources Terraform manages in this workspace
terraform state list

# Filter by resource type
terraform state list | grep aws_instance

# Filter by module
terraform state list | grep "module.vpc"

Example output:

aws_vpc.main
aws_subnet.public[0]
aws_subnet.public[1]
aws_subnet.private[0]
aws_internet_gateway.main
aws_instance.web[0]
aws_instance.web[1]
module.database.aws_db_instance.main
module.database.aws_db_subnet_group.main

This is your managed resource inventory. If something isn’t in this list, Terraform doesn’t know it exists. Handy for answering “did we forget to import that security group everyone keeps referencing?”

terraform state show — Deep Dive on One Resource

terraform state show aws_instance.web
terraform state show "aws_instance.web[0]"      # count-based
terraform state show 'aws_instance.web["prod"]'  # for_each-based
terraform state show module.vpc.aws_vpc.main     # module resource

Output:

# aws_instance.web:
resource "aws_instance" "web" {
    ami                          = "ami-0c55b159cbfafe1f0"
    arn                          = "arn:aws:ec2:us-east-1:123456789:instance/i-0abc123"
    associate_public_ip_address  = true
    availability_zone            = "us-east-1a"
    id                           = "i-0abc123def456"
    instance_state               = "running"
    instance_type                = "t2.micro"
    private_ip                   = "10.0.1.45"
    public_ip                    = "54.123.45.67"
    ...
}

Formatted like HCL, which makes it easy to compare against your config. I use this all the time when a plan shows unexpected changes — pull up the state, compare it to the config, and the discrepancy jumps out.

terraform output — Reading Output Values

# Show all outputs
terraform output

# Show a specific output
terraform output vpc_id

# Get output as raw string (for scripting)
terraform output -raw vpc_id

# Get all outputs as JSON (for scripting)
terraform output -json

Example:

$ terraform output
vpc_id = "vpc-0abc123"
public_subnet_ids = [
  "subnet-0abc",
  "subnet-0def",
]
db_endpoint = <sensitive>

$ terraform output -raw vpc_id
vpc-0abc123

# Use in a script
VPC_ID=$(terraform output -raw vpc_id)
aws ec2 describe-instances --filters "Name=vpc-id,Values=$VPC_ID"

The -raw flag is what you want in scripts. -json for anything downstream that expects structured data.

terraform version — Check What You’re Running

$ terraform version

Terraform v1.7.4
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v5.31.0
+ provider registry.terraform.io/hashicorp/random v3.6.0

Your version of Terraform is out of date! The latest version
is 1.8.0. You can update by downloading from https://www.terraform.io

Shows the CLI version, OS/architecture, and all installed providers with versions. Useful for bug reports. Also useful when someone says “it works on my machine” — the first question is always “what version are you running?”

terraform graph — Visualize the Dependency Graph

# Output in DOT format (Graphviz)
terraform graph

# Generate an SVG (requires graphviz installed)
terraform graph | dot -Tsvg > graph.svg
open graph.svg

# Generate PNG
terraform graph | dot -Tpng > graph.png

For large configs, the graph gets noisy fast. Filter with the -type flag:

terraform graph -type=plan      # What would change in a plan
terraform graph -type=apply     # Full dependency graph
terraform graph -type=destroy   # Destroy ordering

I’ll be honest: I use this maybe twice a year. When I do, it’s because I’m debugging a dependency cycle or trying to understand why Terraform is creating things in an unexpected order. For day-to-day work, you won’t need it.

terraform providers — What’s Installed

# Show providers required by current config
terraform providers

# Show provider schemas (very verbose — pipe to file)
terraform providers schema -json > schema.json | jq .

Output:

Providers required by configuration:
.
├── provider[registry.terraform.io/hashicorp/aws] ~> 5.0
└── provider[registry.terraform.io/hashicorp/random] ~> 3.6

terraform workspace Commands (Preview)

For workspace management (covered in depth in the next article):

terraform workspace list     # List all workspaces
terraform workspace show     # Show current workspace
terraform workspace new dev  # Create a new workspace
terraform workspace select prod  # Switch to workspace

Quick Reference Cheat Sheet

Print this out. Stick it on your wall. You’ll use half of these daily once you’re working with Terraform in production.

Key Takeaways

terraform show reads from state, not from the cloud. If someone modified a resource outside Terraform (drift), terraform show shows the last-known state — not current reality. Run terraform plan -refresh-only first to update state from the actual cloud, then terraform show will be accurate.

terraform output -json reveals sensitive output values in full. They aren’t hidden in JSON mode. Be careful where this output goes — piping it to a log file in CI means your database password is sitting in a build artifact.

In CI/CD pipelines, terraform output -json is the cleanest way to extract infrastructure values (endpoint URLs, IDs, IPs) and pass them to subsequent pipeline stages. Way cleaner than trying to parse terraform apply output with grep and sed.