{"id":60654,"date":"2026-03-03T09:48:53","date_gmt":"2026-03-03T09:48:53","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=60654"},"modified":"2026-03-03T09:48:53","modified_gmt":"2026-03-03T09:48:53","slug":"terraform-step-by-step-use-local-cli-to-modify-remote-state-in-tfe","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/terraform-step-by-step-use-local-cli-to-modify-remote-state-in-tfe\/","title":{"rendered":"Terraform: Step\u2011By\u2011Step: Use Local CLI to Modify Remote State in TFE"},"content":{"rendered":"\n

Below is a step\u2011by\u2011step tutorial<\/strong> for using the Terraform CLI against a VCS\u2011connected HCP\/TFE workspace<\/strong>, plus a command catalog<\/strong> for all the common remote actions.<\/p>\n\n\n\n

Step\u2011By\u2011Step: Use Local CLI to Modify Remote State in TFE<\/strong><\/p>\n\n\n\n

    \n
  1. Verify your Terraform version matches the workspace requirement<\/li>\n<\/ol>\n\n\n
       terraform version<\/code><\/span><\/pre>\n\n\n
    If the workspace requires ~>1.14.0<\/code>, make sure you\u2019re on 1.14.x<\/code>.<\/p>\n\n\n\n
      \n
    1. Authenticate to HCP\/TFE<\/li>\n<\/ol>\n\n\n
         terraform login<\/code><\/span><\/pre>\n\n\n
        \n
      1. Set the remote workspace (pick one method) Option A: Use env vars (fast + explicit)<\/li>\n<\/ol>\n\n\n
           export<\/span> TF_CLOUD_ORGANIZATION=\"Drivemode\"<\/span>\n   export<\/span> TF_WORKSPACE=\"evp-aws-development-core\"<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Option B: Use workspace selection after init<\/p>\n\n\n
           terraform init\n   terraform workspace list<\/span>\n   terraform workspace select evp-aws-development-core<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n
        1. Initialize the backend<\/li>\n<\/ol>\n\n\n
             terraform init<\/code><\/span><\/pre>\n\n\n
            \n
          1. Confirm the remote state is reachable<\/li>\n<\/ol>\n\n\n
               terraform state list<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
              \n
            1. Modify remote state (example: untaint)<\/li>\n<\/ol>\n\n\n
                 terraform untaint 'module.k8s_az_anchor[0].kubernetes_manifest.priority_class[0]'<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                \n
              1. Verify the plan is now clean<\/li>\n<\/ol>\n\n\n
                   terraform plan<\/code><\/span><\/pre>\n\n\n
                That flow modifies the remote state in TFE<\/strong> because your backend is remote and the CLI is authenticated.<\/p>\n\n\n\n
                Remote Run Commands (All Common Commands That Run Remote Actions)<\/strong><\/p>\n\n\n\n
                These commands create or change remote resources<\/strong> (or interact with remote state):<\/p>\n\n\n\n
                  \n
                1. Plan (remote run)<\/li>\n<\/ol>\n\n\n
                     terraform plan<\/code><\/span><\/pre>\n\n\n
                    \n
                  1. Apply (remote run)<\/li>\n<\/ol>\n\n\n
                       terraform apply<\/code><\/span><\/pre>\n\n\n
                      \n
                    1. Destroy (remote run)<\/li>\n<\/ol>\n\n\n
                         terraform destroy<\/code><\/span><\/pre>\n\n\n
                      Alternative:<\/p>\n\n\n
                         terraform apply -destroy<\/code><\/span><\/pre>\n\n\n
                        \n
                      1. Import (writes to remote state)<\/li>\n<\/ol>\n\n\n
                           terraform import <resource_address<\/span>><\/span> <remote_id<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                          \n
                        1. Refresh only (safe read\/update of state)<\/li>\n<\/ol>\n\n\n
                             terraform plan -refresh-only<\/code><\/span><\/pre>\n\n\n
                            \n
                          1. State list (remote state)<\/li>\n<\/ol>\n\n\n
                               terraform state list<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                              \n
                            1. State show (remote state)<\/li>\n<\/ol>\n\n\n
                                 terraform state show <resource_address<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                \n
                              1. State move (remote state)<\/li>\n<\/ol>\n\n\n
                                   terraform state mv <old_address<\/span>><\/span> <new_address<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                  \n
                                1. State remove (remote state)<\/li>\n<\/ol>\n\n\n
                                     terraform state rm <resource_address<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                    \n
                                  1. State pull (remote \u2192 local file) terraform state pull > \/tmp\/tfstate.json<\/code><\/li>\n\n\n\n
                                  2. State push (local file \u2192 remote) terraform state push \/tmp\/tfstate.json<\/code><\/li>\n\n\n\n
                                  3. Replace provider in state (remote state) terraform state replace-provider <old_provider> <new_provider><\/code><\/li>\n\n\n\n
                                  4. Taint \/ Untaint (if supported by your version) terraform taint <resource_address> terraform untaint <resource_address><\/code><\/li>\n\n\n\n
                                  5. Force unlock remote state (rare) terraform force-unlock <LOCK_ID><\/code><\/li>\n\n\n\n
                                  6. Show outputs (remote state)
                                    bash terraform output<\/code><\/li>\n<\/ol>\n\n\n\n
                                    Important behavior in VCS\u2011connected workspaces<\/strong><\/p>\n\n\n\n
                                      \n
                                    • CLI runs use your local config snapshot<\/strong>, not the Git branch snapshot.<\/li>\n\n\n\n
                                    • If CLI\u2011driven runs are disabled in the workspace, plan\/apply\/import<\/code> will fail.<\/li>\n\n\n\n
                                    • State commands still work if your org policy allows<\/strong> and your version matches.<\/li>\n<\/ul>\n\n\n\n
                                      If you want, I can tailor this to your exact workspace settings. Which one is your workspace using?<\/p>\n\n\n\n
                                        \n
                                      1. VCS\u2011connected + CLI runs allowed<\/li>\n\n\n\n
                                      2. VCS\u2011connected + CLI runs disabled<\/li>\n\n\n\n
                                      3. CLI\u2011driven workspace (no VCS)<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
                                        Below is a step\u2011by\u2011step tutorial for using the Terraform CLI against a VCS\u2011connected HCP\/TFE workspace, plus a command catalog for all the common remote actions. Step\u2011By\u2011Step: Use Local CLI to… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-60654","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/60654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=60654"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/60654\/revisions"}],"predecessor-version":[{"id":60655,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/60654\/revisions\/60655"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=60654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=60654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=60654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}