100+ OpenTofu Commands: The Ultimate 2026 Guide to Open-Source IaC

OpenTofu has become the go-to tool for developers who need a reliable, open-source way to manage infrastructure. If you are just starting out or even if you are an experienced engineer, knowing the right commands is crucial for your workflow.

In this guide, we have compiled a comprehensive list of 100+ OpenTofu commands to help you handle every aspect of infrastructure as code.

What is OpenTofu and Why Use It?

OpenTofu is an open-source infrastructure as code tool that allows you to define and provision data center infrastructure using a high-level configuration language. It was created as a fork of Terraform after HashiCorp changed its license. Because it is community-driven, it remains free and open for everyone.

We use OpenTofu to manage resources across cloud providers like AWS, Azure, and Google Cloud. It helps us version our infrastructure, automate deployments, and treat our infrastructure configuration just like application code.

How to Install OpenTofu

To start using OpenTofu, you need to install the binary on your local machine or CI/CD runner. The installation process is straightforward for most operating systems. We have outlined the steps for macOS, Windows, and Linux below.

Installing OpenTofu on macOS

For macOS users, Homebrew is the easiest way to get started. It manages the installation and future updates automatically.

1. Open your Terminal application.
2. Run the following command to install OpenTofu. brew install opentofu
3. Verify the installation by checking the version. tofu --version

Installing OpenTofu on Windows

Windows users can install OpenTofu using Chocolatey or by downloading the binary manually. We recommend Chocolatey for a smoother experience.

1. Open PowerShell as an Administrator.
2. If you use Chocolatey, run the install command. choco install opentofu
3. If you prefer a manual install, download the zip file from the GitHub releases page.
4. Extract the folder and add the executable path to your system PATH environment variable.

Installing OpenTofu on Linux

Linux users can use the official install script or download the binary directly. The script method is the quickest way to set up the environment.

1. Open your terminal.
2. Run the automatic installation script provided by the OpenTofu team. curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh | sh
3. Alternatively, download the appropriate binary from the releases page and move it to /usr/local/bin.

Official Guide: OpenTofu Installation

Essential Initialization OpenTofu Commands

The first step in any OpenTofu project is initialization. These OpenTofu commands prepare your working directory by downloading necessary plugins and setting up the backend. Without these, you cannot proceed with your infrastructure changes.

tofu init

This command initializes a working directory containing OpenTofu configuration files. It downloads the required providers and modules defined in your configuration. We use this command whenever we start a new project or clone an existing one from a repository. It creates the .tofu directory to store internal data.

Example: tofu init

tofu init -upgrade

This command initializes the directory and forces the download of the latest versions of providers and modules. It ignores the cache if a newer version exists in the registry. We use this when we want to update our dependencies to the most recent stable releases.

Example: tofu init -upgrade

tofu init -backend=false

This command initializes the configuration but skips the backend configuration. It allows you to work locally without connecting to a remote state storage. We use this often when we want to test configuration syntax without affecting the shared state file.

Example: tofu init -backend=false

tofu init -reconfigure

This command forces OpenTofu to reconfigure the backend settings. It deletes the previous backend configuration stored in the working directory. We use this when we change the backend type or location, such as moving state from local to remote storage.

Example: tofu init -reconfigure

tofu init -migrate-state

This command helps you migrate your state file when you change backend configurations. It prompts you to confirm the migration of the existing state to the new backend. We use this to ensure no data is lost during backend changes.

Example: tofu init -migrate-state

tofu init -backend-config

This command allows you to pass specific backend configuration values directly from the command line. You can specify a file path or a key-value pair. We use this to dynamically inject secrets or variables into the backend configuration during runtime.

Example: tofu init -backend-config="bucket=my-state-bucket"

tofu init -plugin-dir

This command restricts OpenTofu to use plugins only from a specific directory. It prevents the tool from downloading plugins from the internet. We use this in air-gapped environments where security policies prohibit external downloads.

Example: tofu init -plugin-dir=/custom/plugins

tofu init -from-module

This command initializes a new configuration by downloading a module from a source. It is useful for starting projects from pre-made templates. We use this to quickly set up standard architecture patterns defined by our organization.

Example: tofu init -from-module=github.com/example/vpc-module

Core Workflow OpenTofu Commands

These OpenTofu commands form the core loop of infrastructure management. They allow us to preview changes, apply them, and release resources. Mastering these commands is essential for day-to-day operations.

tofu plan

This command creates an execution plan. It compares the current state with your configuration and shows what changes OpenTofu will make. We use this before every apply to verify that the changes match our expectations. It is a safety net against accidental deletions.

Example: tofu plan

tofu plan -out

This command saves the generated execution plan to a specific file. This file can then be passed to the apply command. We use this in CI/CD pipelines to ensure that the exact plan we reviewed is what gets applied later.

Example: tofu plan -out=myplan.tfplan

tofu plan -destroy

This command creates a plan to destroy all remote objects managed by the current configuration. It shows you what resources will be deleted. We use this to verify the impact of shutting down an environment before actually doing it.

Example: tofu plan -destroy

tofu plan -target

This command limits the plan to specific resources. It allows you to focus on a single module or resource address. We use this when we need to fix a specific part of our infrastructure without affecting other resources.

Example: tofu plan -target=aws_instance.web_server

tofu plan -var

This command allows you to set an input variable directly on the command line for the plan. It overrides the default values in your configuration. We use this for testing different configurations quickly without editing files.

Example: tofu plan -var="instance_type=t2.large"

tofu plan -var-file

This command specifies a file containing variable definitions to use during the plan. It is useful for loading environment-specific variables. We use this to separate production variables from development variables.

Example: tofu plan -var-file="prod.tfvars"

tofu plan -refresh=false

This command skips the default behavior of refreshing the state before planning. It uses the state file exactly as it is. We use this to speed up the planning process when we are certain the remote infrastructure has not changed.

Example: tofu plan -refresh=false

tofu plan -replace

This command forces OpenTofu to plan the replacement of a specific resource. It marks the resource for destruction and recreation. We use this when a resource is corrupted or we need to update an immutable field.

Example: tofu plan -replace="aws_instance.web_server"

tofu apply

This command applies the changes required to reach the desired state of the configuration. It creates, updates, or deletes resources. We use this command to execute the changes defined in our configuration files.

Example: tofu apply

tofu apply -auto-approve

This command applies changes without requiring interactive approval. It skips the “Enter a value” prompt. We use this carefully in automated scripts where manual intervention is not possible.

Example: tofu apply -auto-approve

tofu apply “planfile”

This command applies a previously saved execution plan file. It ensures that only the changes in the plan are executed. We use this to guarantee that the exact plan reviewed by a team member is what runs on the server.

Example: tofu apply "myplan.tfplan"

tofu apply -lock=false

This command disables state locking during the apply process. It allows the apply to proceed even if another process holds the lock. We use this with extreme caution when the locking mechanism is malfunctioning.

Example: tofu apply -lock=false

tofu apply -parallelism

This command sets the number of concurrent operations allowed during the apply. A lower number reduces the load on the API. We use this when working with providers that have strict rate limits.

Example: tofu apply -parallelism=5

tofu apply -refresh-only

This command updates the state file to match the actual remote infrastructure without modifying the resources. It is useful for reconciling drift. We use this when we want to update the state to reflect manual changes made outside OpenTofu.

Example: tofu apply -refresh-only

tofu destroy

This command destroys all remote objects managed by the current configuration. It is a destructive action that cleans up your infrastructure. We use this to decommission environments that are no longer needed.

Example: tofu destroy

tofu destroy -target

This command destroys only the targeted resource or module. It leaves other resources untouched. We use this to remove specific resources that are causing issues or are no longer required.

Example: tofu destroy -target=aws_instance.web_server

tofu destroy -auto-approve

This command destroys resources without asking for interactive confirmation. It is useful for automated cleanup scripts. We use this in development pipelines to tear down temporary environments automatically.

Example: tofu destroy -auto-approve

State Management OpenTofu Commands

State management is one of the most critical aspects of OpenTofu. These OpenTofu commands help us inspect, modify, and move resources within the state file. Proper state management prevents configuration drift and errors.

tofu state list

This command lists all resources currently tracked in the state file. It provides a quick overview of what OpenTofu is managing. We use this to find the exact address of a resource for targeting in other commands.

Example: tofu state list

tofu state show

This command displays the attributes of a specific resource in the state. It shows the current values as known to OpenTofu. We use this to debug issues by checking the current state of a specific resource.

Example: tofu state show aws_instance.web_server

tofu state mv

This command moves an item from one state position to another. It can rename a resource or move it between modules. We use this when we refactor our code but want to preserve the existing resource.

Example: tofu state mv aws_instance.web aws_instance.web_server

tofu state rm

This command removes an item from the state file. It does not delete the actual remote resource. We use this when we want OpenTofu to stop managing a resource but keep the resource running in the cloud.

Example: tofu state rm aws_instance.web_server

tofu state pull

This command pulls the current remote state and prints it to the console. It downloads the state from the backend. We use this to inspect the raw state data or to create a local backup.

Example: tofu state pull

tofu state push

This command pushes a local state file to the remote backend. It overwrites the remote state. We use this to restore a backup or to migrate state between backends manually.

Example: tofu state push backup.tfstate

tofu state replace-provider

This command replaces the provider for resources in the state. It updates the provider URL or version within the state file. We use this when migrating from a deprecated provider to a new one.

Example: tofu state replace-provider registry.terraform.io/hashicorp/aws registry.opentofu.org/hashicorp/aws

tofu state mv -dry-run

This command shows what a state move operation would do without actually performing it. It is a safety check. We use this to verify our move commands before executing them.

Example: tofu state mv -dry-run module.old module.new

tofu import

This command imports an existing remote object into the OpenTofu state. It allows OpenTofu to manage resources created outside of the code. We use this when we start managing pre-existing infrastructure with OpenTofu.

Example: tofu import aws_instance.web_server i-1234567890abcdef0

tofu import -provider

This command imports a resource using a specific provider alias. It is useful in multi-region or multi-account setups. We use this to ensure the resource is imported into the correct provider configuration.

Example: tofu import -provider=aws.west aws_instance.web_server i-1234567890abcdef0

tofu taint

This command manually marks a resource instance as tainted. This forces OpenTofu to destroy and recreate it on the next apply. We use this when we know a resource is broken or needs a configuration refresh that cannot happen in place.

Example: tofu taint aws_instance.web_server

tofu untaint

This command removes the tainted status from a resource. It prevents the resource from being destroyed and recreated. We use this if we accidentally tainted a resource or resolved the issue manually.

Example: tofu untaint aws_instance.web_server

Workspace Management OpenTofu Commands

Workspaces allow us to manage multiple distinct environments within the same configuration directory. These OpenTofu commands help us switch between and manage these environments efficiently.

tofu workspace list

This command lists all existing workspaces in the current configuration. It marks the current workspace with an asterisk. We use this to see which environments are currently configured in our project.

Example: tofu workspace list

tofu workspace new

This command creates a new workspace with the specified name. It creates an isolated state file for that workspace. We use this to set up new environments like staging or production.

Example: tofu workspace new staging

tofu workspace select

This command switches the active workspace to the one specified. It loads the state file associated with that workspace. We use this to switch context between different environments.

Example: tofu workspace select staging

tofu workspace delete

This command deletes a workspace. It removes the state file associated with that workspace. We use this to clean up old environments that are no longer in use.

Example: tofu workspace delete staging

tofu workspace show

This command prints the name of the current workspace. It helps you verify which environment you are working in. We use this in scripts to check the active environment before running changes.

Example: tofu workspace show

Inspection and Validation OpenTofu Commands

Before applying changes, we often need to inspect our code and data. These OpenTofu commands allow us to validate configurations and view outputs without modifying infrastructure.

tofu validate

This command validates the configuration files in the directory. It checks for syntax errors and required arguments. We use this as a pre-commit check to ensure our code is valid before planning.

Example: tofu validate

tofu validate -json

This command runs validation and outputs the result in JSON format. It is easier for machines to parse. We use this to integrate validation results into automated reporting tools.

Example: tofu validate -json

tofu output

This command extracts the value of an output variable from the state file. It displays the result of your infrastructure deployment. We use this to get IP addresses or DNS names after an apply.

Example: tofu output

tofu output -json

This command prints the outputs in JSON format. It allows for easy parsing by scripts and tools like jq. We use this to pass infrastructure data into other automation tools.

Example: tofu output -json

tofu output -raw

This command prints the raw string value of a single output variable. It does not format the output. We use this to pass output directly into command-line arguments or environment variables.

Example: tofu output -raw instance_ip

tofu console

This command starts an interactive console for experimenting with OpenTofu interpolations. It allows you to test expressions and functions. We use this for debugging complex logic or calculating values.

Example: tofu console

tofu graph

This command generates a visual representation of the execution plan. It outputs a graph in DOT format. We use this to visualize the dependency graph of our resources.

Example: tofu graph

tofu graph -type=plan

This command generates the graph specifically for the plan operation. It shows the dependencies calculated during planning. We use this to understand the order of operations.

Example: tofu graph -type=plan

tofu graph -draw-cycles

This command highlights any cycles detected in the configuration graph. Cycles are errors in dependency logic. We use this to debug circular dependency errors.

Example: tofu graph -draw-cycles

tofu show

This command reads a state file or plan file and prints it to the console in a human-readable format. It provides detailed insight into the saved plan or state. We use this to inspect a plan file saved on disk.

Example: tofu show myplan.tfplan

tofu show -json

This command outputs the state or plan in JSON format. It is useful for programmatic access to the data. We use this to analyze infrastructure configurations with custom tools.

Example: tofu show -json

Formatting and Code Quality OpenTofu Commands

Good code formatting is essential for readability and collaboration. These OpenTofu commands help us maintain consistent style across our configurations.

tofu fmt

This command rewrites OpenTofu configuration files to a canonical format and style. It fixes indentation and spacing. We use this before every commit to ensure our code is clean and consistent.

Example: tofu fmt

tofu fmt -check

This command checks if the files are formatted correctly without modifying them. It exits with an error code if files need formatting. We use this in CI pipelines to enforce formatting standards.

Example: tofu fmt -check

tofu fmt -recursive

This command formats files in the current directory and all subdirectories. It ensures the entire project follows the style guide. We use this in large projects with many modules.

Example: tofu fmt -recursive

tofu fmt -diff

This command displays the differences between the original file and the formatted file. It shows what changes the formatter would make. We use this to review style corrections before saving.

Example: tofu fmt -diff

Module and Provider OpenTofu Commands

Modules and providers are the building blocks of OpenTofu configurations. These OpenTofu commands assist in downloading, updating, and inspecting these components.

tofu get

This command downloads and updates modules mentioned in the configuration. It places them in the local module cache. We use this to ensure all required modules are available locally.

Example: tofu get

tofu get -update

This command checks the module source for updates and downloads the latest version. It ignores the local cache. We use this when we want to pull the latest changes from a module repository.

Example: tofu get -update

tofu providers

This command prints a tree of the providers used in the configuration. It shows where each provider is required. We use this to verify that we are using the correct provider versions.

Example: tofu providers

tofu providers schema

This command prints the detailed schemas for all providers used in the configuration. It shows available resources and data sources. We use this for reference when writing configurations without looking up external documentation.

Example: tofu providers schema

tofu providers mirror

This command downloads the providers required by the configuration into a local directory. It creates a mirror of the provider plugins. We use this to create a local filesystem mirror for air-gapped environments.

Example: tofu providers mirror /path/to/mirror

tofu version

This command prints the version of the OpenTofu binary you are running. It also shows the installed provider versions if a lock file exists. We use this to verify our environment setup.

Example: tofu version

tofu version -json

This command outputs the version information in JSON format. It includes detailed metadata about the binary. We use this in automation scripts to parse version numbers programmatically.

Example: tofu version -json

Advanced Utility OpenTofu Commands

These OpenTofu commands are for advanced troubleshooting, debugging, and specialized workflows. They help us interact with the system at a lower level.

tofu login

This command obtains and saves an API token for a given host. It is used for authenticating with private module registries. We use this to access private modules or cloud backends that require authentication.

Example: tofu login app.terraform.io

tofu logout

This command removes the stored API token for a given host. It effectively signs you out of the registry. We use this to clean up credentials on shared machines.

Example: tofu logout app.terraform.io

tofu force-unlock

This command manually unlocks the state. It is used when a lock persists after a crash or interruption. We use this carefully to restore access to the state when the system is stuck.

Example: tofu force-unlock LOCK_ID

tofu test

This command executes automated tests against the OpenTofu configuration. It validates the behavior of modules. We use this to verify our infrastructure logic works as expected.

Example: tofu test

tofu test -verbose

This command runs tests with detailed output. It shows the specific steps and assertions being made. We use this when debugging failing tests to understand why they failed.

Example: tofu test -verbose

tofu metadata functions

This command lists all the available functions in the OpenTofu language. It helps you discover built-in logic you can use. We use this as a quick reference when writing complex expressions.

Example: tofu metadata functions

Global Flags for OpenTofu Commands

While these are not standalone commands, these flags modify the behavior of almost all OpenTofu commands. Understanding them is necessary for effective usage.

tofu command -chdir

This flag allows you to run the command from a different directory than your current working directory. It changes the working directory before executing. We use this when our scripts are located in a different folder than our configuration.

Example: tofu -chdir=infra/apply plan

tofu command -help

This flag displays help text for any command. It explains the usage and available options. We use this whenever we need a quick reminder of how to use a specific command.

Example: tofu plan -help

tofu command -compact-warnings

This flag shows warnings in a more compact format that excludes the initial summary. It reduces the output clutter. We use this when we only care about the error output.

Example: tofu plan -compact-warnings

tofu command -no-color

This flag disables the output colors in the terminal. It produces plain text output. We use this when redirecting output to files or logs that do not support color codes.

Example: tofu apply -no-color

Conclusion

These OpenTofu commands will significantly improve your infrastructure management skills. As you continue to explore and practice, you will find that these tools give you complete control over your cloud environment.

For more details and official documentation, please visit the OpenTofu Documentation.

Since OpenTofu is a fork of Terraform, many of the core concepts remain the same. If you are just starting your Infrastructure as Code journey or want to see how these commands compare to the industry standard, check out our guide on Terraform CLI Commands Explained for Beginners to master the foundations before diving into the open-source ecosystem.