Configuration reference

Knobs Terraform reads from environment variables, the user's CLI config file, and the working directory.

Environment variables

Variable	Used by	Notes
TF_LOG	internal/logging/	Master log level: TRACE, DEBUG, INFO, WARN, ERROR.
TF_LOG_CORE	internal/logging/	Same severities, applies only to Terraform Core (excludes provider plugins).
TF_LOG_PROVIDER	internal/logging/	Same severities, applies only to provider plugins.
TF_LOG_PATH	internal/logging/	If set, all log lines (regardless of routing) write to this file.
TF_DATA_DIR	internal/command/workdir/	Override .terraform/ location.
TF_INPUT	internal/command/	If 0/false, equivalent to -input=false on every command.
TF_IN_AUTOMATION	commands.go	Suppresses tips that assume an interactive prompt.
TF_CLI_ARGS	main.go	Extra args spliced after the first non-flag arg of every invocation.
TF_CLI_ARGS_<subcommand>	main.go	Same, scoped to one subcommand.
TF_REATTACH_PROVIDERS	internal/getproviders/reattach/	Connect to already-running provider processes (debugger workflow).
TF_PLUGIN_CACHE_DIR	internal/command/cliconfig/	Override plugin_cache_dir.
TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE	internal/command/cliconfig/	Permits the plugin cache to mutate provider hashes in the lock file (Off by default; turning this on can compromise reproducibility).
TF_TOKEN_<host>	svchost/auth	API token for the named host (e.g. TF_TOKEN_app_terraform_io).
TF_VAR_<name>	internal/command/arguments/	Set input variable <name>.
TF_REGISTRY_DISCOVERY_RETRY	internal/registry/	Retry count for registry discovery requests.
TF_REGISTRY_CLIENT_TIMEOUT	internal/registry/	Per-request timeout for registry calls.
TF_TEMP_LOG_PATH	main.go	Internal: a parent process can pre-create a temp log file and pass its path here.
TERRAFORM_OPENTELEMETRY_EXPORTER	telemetry.go (root)	Opt-in OTel exporter selection.
TF_ACC	tests	Enables acceptance tests that contact external services.

~/.terraformrc / terraform.rc

The CLI configuration file lives at ~/.terraformrc on POSIX systems and %APPDATA%\terraform.rc on Windows. The parser is in internal/command/cliconfig/. Notable blocks:

plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"
plugin_cache_may_break_dependency_lock_file = false

disable_checkpoint = false
disable_checkpoint_signature = false

provider_installation {
  filesystem_mirror {
    path    = "/opt/terraform/providers"
    include = ["registry.terraform.io/*/*"]
  }
  network_mirror {
    url     = "https://terraform-mirror.example.com/"
  }
  direct {
    exclude = ["registry.terraform.io/example-corp/*"]
  }
  dev_overrides {
    "example-corp/aws" = "/Users/me/code/terraform-provider-aws"
  }
}

host "app.terraform.io" {
  services = {
    "modules.v1"   = "https://app.terraform.io/api/registry/v1/modules/"
    "providers.v1" = "https://app.terraform.io/api/registry/v1/providers/"
  }
}

credentials "app.terraform.io" {
  token = "..."
}

credentials_helper "vault" {
  args = []
}

The provider_installation block is consumed by provider_source.go (root package) when constructing the multi-source. host {} overrides service-discovery responses. credentials {} sets API tokens directly; credentials_helper {} invokes a plugin to fetch them.

Working-directory layout (.terraform/)

When you run terraform init, Terraform creates .terraform/ in the working directory. Subdirectories:

Path	Contents	Maintained by
.terraform/providers/<host>/<namespace>/<name>/<version>/<platform>/	Extracted provider binaries.	internal/providercache/
.terraform/modules/<key>/...	Installed module sources.	internal/initwd/
.terraform/modules/modules.json	Manifest of installed modules.	internal/initwd/
.terraform/terraform.tfstate	Backend marker file: which backend was init'd, plus its non-secret config.	internal/command/meta_backend.go
.terraform/environment	Selected workspace name (when applicable).	internal/command/workspace_*.go

The whole directory is local to the working tree and should be gitignored.

State and lock files (in the working dir)

File	Purpose	Maintained by
terraform.tfstate	Local state (default local backend, default workspace).	internal/states/statemgr/Filesystem
terraform.tfstate.backup	Previous state, written before each save.	Filesystem
terraform.tfstate.d/<workspace>/terraform.tfstate	Workspace-scoped state for the local backend.	Filesystem
terraform.tfstate.lock.info	Cooperative lock file.	Filesystem.Lock/Unlock
.terraform.lock.hcl	Provider dependency lock.	internal/depsfile/

Per-command flags

Every subcommand has its own flag surface. Centralized definitions for many of them live in internal/command/arguments/. The most universally relevant flags:

• -chdir=DIR — change working dir before running (parsed in main.go).
• -help, -version, -v — handled in main.go before dispatch.
• -json — switch the view layer to JSON output. Supported by most major commands.
• -no-color — disable colorized output.
• -input=false — disable interactive prompts.

For each subcommand, the most direct way to find the flags is to read its Help() method or the corresponding file under internal/command/arguments/.