Terraform: Step‑By‑Step: Use Local CLI to Modify Remote State in TFE

Below is a step‑by‑step tutorial for using the Terraform CLI against a VCS‑connected HCP/TFE workspace, plus a command catalog for all the common remote actions.

Step‑By‑Step: Use Local CLI to Modify Remote State in TFE

1. Verify your Terraform version matches the workspace requirement

   terraform version

If the workspace requires ~>1.14.0, make sure you’re on 1.14.x.

2. Authenticate to HCP/TFE

   terraform login

3. Set the remote workspace (pick one method) Option A: Use env vars (fast + explicit)

   export TF_CLOUD_ORGANIZATION="Drivemode"
   export TF_WORKSPACE="evp-aws-development-core"Code language: JavaScript (javascript)

Option B: Use workspace selection after init

   terraform init
   terraform workspace list
   terraform workspace select evp-aws-development-coreCode language: PHP (php)

4. Initialize the backend

   terraform init

5. Confirm the remote state is reachable

   terraform state listCode language: PHP (php)

6. Modify remote state (example: untaint)

   terraform untaint 'module.k8s_az_anchor[0].kubernetes_manifest.priority_class[0]'Code language: JavaScript (javascript)

7. Verify the plan is now clean

   terraform plan

That flow modifies the remote state in TFE because your backend is remote and the CLI is authenticated.

Remote Run Commands (All Common Commands That Run Remote Actions)

These commands create or change remote resources (or interact with remote state):

1. Plan (remote run)

   terraform plan

2. Apply (remote run)

   terraform apply

3. Destroy (remote run)

   terraform destroy

Alternative:

   terraform apply -destroy

4. Import (writes to remote state)

   terraform import <resource_address> <remote_id>Code language: HTML, XML (xml)

5. Refresh only (safe read/update of state)

   terraform plan -refresh-only

6. State list (remote state)

   terraform state listCode language: PHP (php)

7. State show (remote state)

   terraform state show <resource_address>Code language: HTML, XML (xml)

8. State move (remote state)

   terraform state mv <old_address> <new_address>Code language: HTML, XML (xml)

9. State remove (remote state)

   terraform state rm <resource_address>Code language: HTML, XML (xml)

10. State pull (remote → local file) terraform state pull > /tmp/tfstate.json
11. State push (local file → remote) terraform state push /tmp/tfstate.json
12. Replace provider in state (remote state) terraform state replace-provider <old_provider> <new_provider>
13. Taint / Untaint (if supported by your version) terraform taint <resource_address> terraform untaint <resource_address>
14. Force unlock remote state (rare) terraform force-unlock <LOCK_ID>
15. Show outputs (remote state)
    bash terraform output

Important behavior in VCS‑connected workspaces

• CLI runs use your local config snapshot, not the Git branch snapshot.
• If CLI‑driven runs are disabled in the workspace, plan/apply/import will fail.
• State commands still work if your org policy allows and your version matches.

If you want, I can tailor this to your exact workspace settings. Which one is your workspace using?

1. VCS‑connected + CLI runs allowed
2. VCS‑connected + CLI runs disabled
3. CLI‑driven workspace (no VCS)

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.