Terraform Tutorial — Debug Logging
When standard error messages aren’t enough, Terraform’s debug logging shows exactly what’s happening — every API call, every state change, every decision.
TF_LOG Environment Variable
$ export TF_LOG=DEBUG
$ terraform plan
Log levels (from least to most verbose):
| Level | What It Shows |
|---|---|
ERROR |
Only errors |
WARN |
Errors + warnings |
INFO |
General information |
DEBUG |
Detailed debug information |
TRACE |
Everything (very verbose!) |
Saving Logs to a File
$ export TF_LOG=DEBUG
$ export TF_LOG_PATH="terraform-debug.log"
$ terraform plan
# Logs go to the file instead of terminal
$ less terraform-debug.log
Provider-Specific Logging
Log only provider activity:
$ export TF_LOG_PROVIDER=TRACE
$ terraform apply
Or only core Terraform:
$ export TF_LOG_CORE=DEBUG
$ terraform apply
What to Look For in Logs
API Calls
DEBUG: [aws-sdk-go] DEBUG: Request s3/CreateBucket Details:
---[ REQUEST ]---
POST / HTTP/1.1
Host: my-bucket.s3.us-east-1.amazonaws.com
Authentication
DEBUG: Trying to get credentials from environment variables
DEBUG: Using credentials from shared credentials file (~/.aws/credentials)
State Operations
DEBUG: Writing state to backend "s3"
DEBUG: Acquiring state lock...
DEBUG: Lock acquired.
Disable Logging
$ unset TF_LOG
$ unset TF_LOG_PATH
Troubleshooting Checklist
When something goes wrong, follow this order:
- Read the error message — Terraform messages are usually clear
- Check credentials:
aws sts get-caller-identity - Check provider version:
terraform version - Run plan first:
terraform plan - Enable debug logs:
export TF_LOG=DEBUG - Check provider docs: registry.terraform.io
- Search the error: Google the exact error message
- Check GitHub issues: Provider’s GitHub repo
What’s Next?
Practice troubleshooting with the exercises.
