OpenTofu Cheat Sheet: 31 CLI Commands You Should Know

To install OpenTofu, download the binary from the official releases and add it to your system’s PATH. Below are the installation steps:

1. Visit the OpenTofu GitHub Releases and download the appropriate archive for your OS and architecture (e.g., opentofu_linux_amd64.zip).
2. Unzip the archive and move the tofu binary to a directory in your PATH, such as /usr/local/bin:

3. Confirm it’s installed by running tofu version.

Alternatively, you can install it via package managers like Homebrew (macOS/Linux) using:

For full platform support, see the installation docs.

The basic commands for the OpenTofu CLI follow the same structure as Terraform and include initialization, validation, planning, application, and destruction of infrastructure configurations. These are the core commands you’ll use most often.

tofu init –  Initializes the working directory, downloads providers, and configures the backen

tofu validate –  Checks your configuration for syntax and logical errors

tofu plan – Previews what changes will happen before you apply them

tofu apply – Executes the plan and applies changes to reach the desired state. It can optionally take a plan file.

tofu destroy – Removes all defined resources, effectively tearing down the infrastructure

tofu fmt – Formats your configuration files for consistency

tofu show – Displays the current state or a saved plan in a human-readable format

tofu import – Brings existing infrastructure resources under management by importing them into state

The OpenTofu CLI tracks deployed resources using a state file. These commands help you inspect, update, or repair that state.

tofu state list – Lists all resources tracked in the current state file

tofu state show <address> – Displays detailed information about a specific resource in the state

tofu state mv <source> <destination> – Moves or renames resources within the state file without modifying infrastructure

tofu state rm <address> – Removes a resource from the state (for example, if you deleted it manually)

tofu state pull – Downloads the entire state file from a remote backend

tofu state push – Releases a stale state lock when an operation has failed or timed out

Note: OpenTofu automatically creates a backup state file when modifying state.

Workspaces allow you to isolate environments, such as development, staging, and production, under the same configuration. Each workspace maintains its own state, making it easy to manage multiple environments in parallel.

The primary workspace management commands are:

tofu workspace list – Lists all existing workspaces

tofu workspace show – Displays the currently active workspace

tofu workspace new <name> – Creates a new workspace with the specified name

tofu workspace select <name> – Switches to an existing workspace

tofu workspace delete <name> – Deletes a workspace and its associated state

Modules let you reuse configuration blocks across projects. OpenTofu doesn’t have many module-specific commands beyond get, but these are the key ones for managing and updating modules:

tofu get – Downloads modules declared in the configuration

tofu get -update – Re-downloads modules even if already present

tofu init – Also retrieves modules as part of initialization

These commands primarily support configuration consistency, dependency management, and secure remote operations, complementing OpenTofu’s core workflow commands.

tofu output – Displays values defined as outputs in your configuration

tofu graph – Generates a dependency graph in DOT format for visualization

tofu providers – Lists required providers and their sources

tofu providers lock – Creates or updates the dependency lock file to ensure consistent provider versions

tofu login – Authenticates with a remote backend or registry, if supported

tofu logout – Removes stored credentials from previous logins

tofu version – Shows the current OpenTofu version and build details

tofu test – Runs infrastructure tests and assertions defined in the configuration

tofu console – Opens an interactive console for evaluating expressions and testing configurations

Each OpenTofu command supports a range of flags and options to adjust behavior, control output, and fine-tune execution. Below are the most common ones by command.

tofu init

• -backend=false – Skips backend configuration
• -upgrade – Upgrades providers and modules
• -reconfigure – Ignores previous backend settings and reinitializes configuration
• -migrate-state – Migrates existing state to a new backend configuration
• -force-copy – Force copy of existing state when reinitializing
• -backend-config=FILE – Specify backend configuration files or key=value pairs (see documentation for more info)
• -input=false – Disables prompts in CI
• -from-module=SOURCE – Scaffolds an empty dir from a module repo then init
• -get=false – Skips downloading child modules (handy in pre-seeded builds)
• -plugin-dir=PATH – Uses only local provider plugins 
• -lockfile=readonly – Verifies dependency lockfile without modifying it
  

tofu plan

• -out=FILE – Saves the plan to a file for later use with apply
• -var 'key=value' – Sets a variable inline
• -var-file=FILE – Loads variables from a .tfvars file
• -input=false – Disables interactive input prompts
• -target=RESOURCE – Plans only the specified resource(s)
• -destroy – Creates a plan to destroy resources
• -replace=RESOURCE – Forces replacement of a specific resource
• -refresh-only – plan that only refreshes state/outputs
• -refresh=false – skips the pre-plan refresh (faster, use with care)
• -detailed-exitcode – CI-friendly exit codes (0/1/2)
• -target-file=FILE – Provides multiple target addresses from a file.
• -exclude=ADDRESS / -exclude-file=FILE – Omits specified addresses
• -json – Outputs machine-readable JSON results

tofu apply

• -auto-approve – Skips interactive approval
• -input=false – Prevents prompts for input
• FILE – If provided, applies a plan file generated by plan
• -replace=RESOURCE – Forces replacement of resources during apply
• -lock / -lock-timeout=DURATION – Controls state locking
• -parallelism=N – Sets number of parallel operations
• -json – Outputs machine-readable JSON results
• -no-color / -concise – Cleaner logs in CI
• -show-sensitive – Shows unredacted sensitive values (use carefully)
• -deprecation=module:{all|local|none} – Tunes deprecation warnings

tofu destroy

• -auto-approve – Destroys resources without confirmation
• -target=RESOURCE – Destroys only specified resource(s)
• -var / –var-file / -input=false – Supported same as plan/apply

tofu validate

• -json – Returns validation results as JSON for programmatic use
• -no-color – Produces plain output
• -var / -var-file – Sets variables if configuration references them

tofu fmt

• -recursive – Recursively formats all .tf files in subdirectories
• -check – Checks formatting without changing files
• -write=false – Performs a dry run format check
• -list=false – Doesn’t print filenames needing changes
• -diff – Shows diffs of what would change

Global options (apply to any command)

• -chdir=DIR – Runs command in another directory
• -help – Displays command help
• -version – Shows CLI version information

Note: This is not a complete list. For all options, see the official documentation.

Here are some known deprecated or discouraged commands/options in OpenTofu (or things flagged as deprecated / legacy):

tofu refresh – deprecated because it directly updates the state without opportunity to review changes; using tofu apply -refresh-only is now preferred

tofu taint – deprecated; recommended alternative is tofu apply -replace="…"; tofu untaint remains supported and is not deprecated

tofu env – deprecated, replaced by tofu workspace

Spacelift is an infrastructure orchestration platform that supports both OpenTofu and Terraform, as well as other tools such as Pulumi, CloudFormation, Terragrunt, Ansible, and Kubernetes. Spacelift offers a variety of features that map easily to your OpenTofu and Terraform workflow.

Spacelift stacks enable you to plug in the VCS repository containing your Terraform and OpenTofu configuration files and do a GitOps workflow for them. 

At the stack level, you can add a variety of other components that will influence this GitOps workflow, such as:

• Policies control the kind of resources engineers can create, their parameters, the number of approvals you need for runs, where to send notifications, and more.
• Stack dependencies allow you to build dependencies between your configurations and even share outputs between them. There are no constraints on creating dependencies between multiple tools or the number of dependencies you can have.
• Cloud integrations are dynamic credentials for major cloud providers (AWS, Microsoft Azure, Google Cloud).
• Contexts are shareable containers for your environment variables, mounted files, and lifecycle hooks.
• Drift detection allows you to detect infrastructure drift easily and optionally remediate it.
• Resources view provides enhanced observability of all resources deployed with your Spacelift account.

If you need help migrating from Terraform to OpenTofu or are looking for an infrastructure management platform that supports the top flavors of infrastructure as code, configuration management, and container orchestration, contact Spacelift.

As a founding partner of the initiative, Spacelift offers the native and commercial support you need to ensure your OpenTofu success. Learn more about OpenTofu Commercial Support & Services.

OpenTofu makes managing infrastructure simple, predictable, and fully open source. With just a few commands, you can plan, deploy, and manage your environments much like Terraform — but without vendor lock-in.

Keep this cheat sheet nearby as a quick reference. As you get more comfortable, explore automation through CI/CD pipelines or modular workflows for more complex setups.

If you want to improve your OpenTofu workflow, Spacelift can help. Create a free account today or schedule a demo with one of our engineers.