Terraform: Step‑By‑Step: Use Local CLI to Modify Remote State in TFE

Below is a step‑by‑step tutorial for using the Terraform CLI against a VCS‑connected HCP/TFE workspace, plus a command catalog for all the common remote actions.

Step‑By‑Step: Use Local CLI to Modify Remote State in TFE

1. Verify your Terraform version matches the workspace requirement

   terraform version

If the workspace requires ~>1.14.0, make sure you’re on 1.14.x.

2. Authenticate to HCP/TFE

   terraform login

3. Set the remote workspace (pick one method) Option A: Use env vars (fast + explicit)

   export TF_CLOUD_ORGANIZATION="Drivemode"
   export TF_WORKSPACE="evp-aws-development-core"Code language: JavaScript (javascript)

Option B: Use workspace selection after init

   terraform init
   terraform workspace list
   terraform workspace select evp-aws-development-coreCode language: PHP (php)

4. Initialize the backend

   terraform init

5. Confirm the remote state is reachable

   terraform state listCode language: PHP (php)

6. Modify remote state (example: untaint)

   terraform untaint 'module.k8s_az_anchor[0].kubernetes_manifest.priority_class[0]'Code language: JavaScript (javascript)

7. Verify the plan is now clean

   terraform plan

That flow modifies the remote state in TFE because your backend is remote and the CLI is authenticated.

Remote Run Commands (All Common Commands That Run Remote Actions)

These commands create or change remote resources (or interact with remote state):

1. Plan (remote run)

   terraform plan

2. Apply (remote run)

   terraform apply

3. Destroy (remote run)

   terraform destroy

Alternative:

   terraform apply -destroy

4. Import (writes to remote state)

   terraform import <resource_address> <remote_id>Code language: HTML, XML (xml)

5. Refresh only (safe read/update of state)

   terraform plan -refresh-only

6. State list (remote state)

   terraform state listCode language: PHP (php)

7. State show (remote state)

   terraform state show <resource_address>Code language: HTML, XML (xml)

8. State move (remote state)

   terraform state mv <old_address> <new_address>Code language: HTML, XML (xml)

9. State remove (remote state)

   terraform state rm <resource_address>Code language: HTML, XML (xml)

10. State pull (remote → local file) terraform state pull > /tmp/tfstate.json
11. State push (local file → remote) terraform state push /tmp/tfstate.json
12. Replace provider in state (remote state) terraform state replace-provider <old_provider> <new_provider>
13. Taint / Untaint (if supported by your version) terraform taint <resource_address> terraform untaint <resource_address>
14. Force unlock remote state (rare) terraform force-unlock <LOCK_ID>
15. Show outputs (remote state)
    bash terraform output

Important behavior in VCS‑connected workspaces

• CLI runs use your local config snapshot, not the Git branch snapshot.
• If CLI‑driven runs are disabled in the workspace, plan/apply/import will fail.
• State commands still work if your org policy allows and your version matches.

If you want, I can tailor this to your exact workspace settings. Which one is your workspace using?

1. VCS‑connected + CLI runs allowed
2. VCS‑connected + CLI runs disabled
3. CLI‑driven workspace (no VCS)

Rajesh Kumar

I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I have worked at Cotocus. I share tech blog at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow , and SEO strategies at Wizbrand.

Do you want to learn Quantum Computing?

Please find my social handles as below;

Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at WIZBRAND

Rajesh Kumar DailyLogs