> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Debugging Terraform
> Guide for enabling and capturing Terraform internal logs, using TF_LOG variables and TF_LOG_PATH, choosing log levels, targeting Core or providers, and best practices for secure debugging
In this guide you’ll learn how to enable and capture Terraform’s internal logs for troubleshooting, auditing, or when preparing bug reports. These environment variables and workflows are commonly expected knowledge for the Terraform Associate Certification and practical debugging tasks.
Why logging matters
* Reproduce unexpected behavior (resources not created, unexpected diffs, confusing errors).
* Provide detailed trace-level logs when filing bug reports with HashiCorp or provider maintainers.
* Audit API calls, provider interactions, and Terraform Core decisions during planning and apply phases.
By default Terraform emits only user-facing messages (summaries and errors). Enabling logging reveals internal operations and API traffic — invaluable for debugging but often very verbose.
When to enable detailed logs
* You're investigating non-deterministic or unexplained Terraform behavior.
* A provider or the Terraform binary returns unclear errors.
* You need trace-level evidence to open a bug/issue with maintainers.
* You want to learn how Terraform orchestrates provider calls and state transitions.
Environment variables and log levels
| Environment Variable | Purpose | Example |
| -------------------- | ---------------------------------------------------------------------------------- | ---------------------------------- |
| `TF_LOG` | Enable logging for both Core and providers (global). | `export TF_LOG=TRACE` |
| `TF_LOG_CORE` | Target logging specifically to Terraform Core (dependency graph, state, planning). | `export TF_LOG_CORE=DEBUG` |
| `TF_LOG_PROVIDER` | Target logging specifically to provider plugins (AWS, Azure, Kubernetes, etc.). | `export TF_LOG_PROVIDER=TRACE` |
| `TF_LOG_PATH` | File path to append logs. Only works when a TF\_LOG\*/TF\_LOG variable is set. | `export TF_LOG_PATH=terraform.log` |
Log levels (most → least verbose)
* `TRACE` — most detailed; recommended for bug reports.
* `DEBUG` — developer-level detail; slightly less noisy than TRACE.
* `INFO` — high-level informational messages.
* `WARN` — potential issues worth attention.
* `ERROR` — only actual error messages.
Enabling logging (examples)
Bash (Linux / macOS)
```bash theme={null}
# Enable the most detailed logs
export TF_LOG=TRACE
terraform plan
```
PowerShell (Windows)
```powershell theme={null}
# Enable the most detailed logs
$env:TF_LOG = "TRACE"
terraform plan
```
Targeting Core vs. Providers
To narrow down whether an issue stems from Terraform Core or a provider plugin, set the Core and Provider variables separately:
Bash
```bash theme={null}
export TF_LOG_CORE=TRACE
export TF_LOG_PROVIDER=TRACE
terraform plan
```
PowerShell
```powershell theme={null}
$env:TF_LOG_CORE = "TRACE"
$env:TF_LOG_PROVIDER = "TRACE"
terraform plan
```
Capturing logs to a file
By default Terraform writes logs to `STDERR`. To save logs to a file, set `TF_LOG_PATH` in addition to a logging level:
Bash
```bash theme={null}
export TF_LOG=TRACE
export TF_LOG_PATH=terraform.log
terraform plan
```
PowerShell
```powershell theme={null}
$env:TF_LOG = "TRACE"
$env:TF_LOG_PATH = "terraform.log"
terraform plan
```
Important details and best practices
* `TF_LOG_PATH` does nothing by itself — you must set `TF_LOG`, `TF_LOG_CORE`, or `TF_LOG_PROVIDER`.
* Logs are appended to the file; rotate or remove the file between runs if you want fresh logs per session.
* Terraform will create the file automatically if it does not exist.
* Log files can become very large at `TRACE` level; prefer targeted runs or rotate logs frequently.
* When troubleshooting, prefer `DEBUG` or `TRACE` only for the shortest time necessary to reduce noise and exposure.
Terraform logs (especially `TRACE`-level) can contain sensitive information such as credentials, tokens, or resource attributes. Be careful when saving, sharing, or uploading logs. Redact or sanitize logs before sharing externally.
Structured logs and machine parsing
Some Terraform versions and environments support structured logging or options to emit logs in machine-readable formats (JSON) or provide ways to post-process trace output. Check the official Terraform environment variables and CLI docs for version-specific guidance:
* HashiCorp Terraform environment variables: [https://developer.hashicorp.com/terraform/cli/config/environment-variables](https://developer.hashicorp.com/terraform/cli/config/environment-variables)
Quick exam & quick-reference summary
Remember these essentials for studying and troubleshooting:
* Key variables: `TF_LOG`, `TF_LOG_CORE`, `TF_LOG_PROVIDER`, `TF_LOG_PATH`.
* Log level order (most → least verbose): `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`.
* `TF_LOG_PATH` only works when a TF\_LOG variable is set.
* Logs default to `STDERR`; use `TF_LOG_PATH` to write to a file.
References and further reading
* Terraform CLI environment variables — [https://developer.hashicorp.com/terraform/cli/config/environment-variables](https://developer.hashicorp.com/terraform/cli/config/environment-variables)
* Terraform documentation and provider docs for vendor-specific debugging guidance
That covers the essentials of Terraform logging. When a problem proves difficult to reproduce or diagnose, enabling the appropriate log level and capturing the output to a file will often reveal the cause.