Skip to main content
In this guide you’ll learn how to enable and capture Terraform’s internal logs for troubleshooting, auditing, or when preparing bug reports. These environment variables and workflows are commonly expected knowledge for the Terraform Associate Certification and practical debugging tasks. Why logging matters
  • Reproduce unexpected behavior (resources not created, unexpected diffs, confusing errors).
  • Provide detailed trace-level logs when filing bug reports with HashiCorp or provider maintainers.
  • Audit API calls, provider interactions, and Terraform Core decisions during planning and apply phases.
By default Terraform emits only user-facing messages (summaries and errors). Enabling logging reveals internal operations and API traffic — invaluable for debugging but often very verbose. When to enable detailed logs
  • You’re investigating non-deterministic or unexplained Terraform behavior.
  • A provider or the Terraform binary returns unclear errors.
  • You need trace-level evidence to open a bug/issue with maintainers.
  • You want to learn how Terraform orchestrates provider calls and state transitions.
Environment variables and log levels
Environment VariablePurposeExample
TF_LOGEnable logging for both Core and providers (global).export TF_LOG=TRACE
TF_LOG_CORETarget logging specifically to Terraform Core (dependency graph, state, planning).export TF_LOG_CORE=DEBUG
TF_LOG_PROVIDERTarget logging specifically to provider plugins (AWS, Azure, Kubernetes, etc.).export TF_LOG_PROVIDER=TRACE
TF_LOG_PATHFile path to append logs. Only works when a TF_LOG*/TF_LOG variable is set.export TF_LOG_PATH=terraform.log
Log levels (most → least verbose)
  • TRACE — most detailed; recommended for bug reports.
  • DEBUG — developer-level detail; slightly less noisy than TRACE.
  • INFO — high-level informational messages.
  • WARN — potential issues worth attention.
  • ERROR — only actual error messages.
Enabling logging (examples) Bash (Linux / macOS) 
# Enable the most detailed logs
export TF_LOG=TRACE
terraform plan
PowerShell (Windows) 
# Enable the most detailed logs
$env:TF_LOG = "TRACE"
terraform plan
Targeting Core vs. Providers To narrow down whether an issue stems from Terraform Core or a provider plugin, set the Core and Provider variables separately: Bash 
export TF_LOG_CORE=TRACE
export TF_LOG_PROVIDER=TRACE
terraform plan
PowerShell 
$env:TF_LOG_CORE = "TRACE"
$env:TF_LOG_PROVIDER = "TRACE"
terraform plan
Capturing logs to a file By default Terraform writes logs to STDERR. To save logs to a file, set TF_LOG_PATH in addition to a logging level: Bash 
export TF_LOG=TRACE
export TF_LOG_PATH=terraform.log
terraform plan
PowerShell 
$env:TF_LOG = "TRACE"
$env:TF_LOG_PATH = "terraform.log"
terraform plan
Important details and best practices
  • TF_LOG_PATH does nothing by itself — you must set TF_LOG, TF_LOG_CORE, or TF_LOG_PROVIDER.
  • Logs are appended to the file; rotate or remove the file between runs if you want fresh logs per session.
  • Terraform will create the file automatically if it does not exist.
  • Log files can become very large at TRACE level; prefer targeted runs or rotate logs frequently.
  • When troubleshooting, prefer DEBUG or TRACE only for the shortest time necessary to reduce noise and exposure.
Terraform logs (especially TRACE-level) can contain sensitive information such as credentials, tokens, or resource attributes. Be careful when saving, sharing, or uploading logs. Redact or sanitize logs before sharing externally.
Structured logs and machine parsing Some Terraform versions and environments support structured logging or options to emit logs in machine-readable formats (JSON) or provide ways to post-process trace output. Check the official Terraform environment variables and CLI docs for version-specific guidance: Quick exam & quick-reference summary
Remember these essentials for studying and troubleshooting:
  • Key variables: TF_LOG, TF_LOG_CORE, TF_LOG_PROVIDER, TF_LOG_PATH.
  • Log level order (most → least verbose): TRACE, DEBUG, INFO, WARN, ERROR.
  • TF_LOG_PATH only works when a TF_LOG variable is set.
  • Logs default to STDERR; use TF_LOG_PATH to write to a file.
References and further reading That covers the essentials of Terraform logging. When a problem proves difficult to reproduce or diagnose, enabling the appropriate log level and capturing the output to a file will often reveal the cause.

Watch Video