TFTUI — the Terraform textual UI

TFTUI is a terminal UI for viewing and working with your Terraform state.

Browse the full state tree, search it, read individual resources, reveal sensitive values, taint or remove resources, and create and apply plans — without leaving the terminal.

More screenshots: docs/screenshots.md

Features

• Full state tree, with modules nested as they are in your configuration
• Search across resource names and their definitions
• Read a single resource with HCL syntax highlighting
• Reveal sensitive values on demand
• Select one resource, or a whole module at a time, and taint, untaint or remove from state
• Create plans — including targeted and destroy plans — in full colour, search them, and apply them
• Switch workspaces without restarting
• Works with Terraform, OpenTofu and wrappers such as Terragrunt

Installation

Requires Python 3.10 or newer and a terraform (or compatible) binary on PATH.

Keys

Press ? in the application for the full list.

Configuration

Every option can be set with a flag or an environment variable. Flags win.

Several var-files

Repeat -f as often as you need; the files are applied in order, so a later one overrides an earlier one. They are passed to init as well as to plan, which is what OpenTofu 1.8+ needs to evaluate variables used in a backend block.

tftui -f common.tfvars -f prod.tfvars

The environment variable takes a list separated by your platform's path separator (: on Linux and macOS, ; on Windows):

export TFTUI_VAR_FILE="common.tfvars:prod.tfvars"

Using OpenTofu or Terragrunt

tftui --executable tofu
tftui --executable terragrunt

Handling of sensitive data

Terraform state routinely contains secrets, so tftui is deliberate about them:

• Sensitive attributes stay redacted as (sensitive value) until you press X.
• When revealed, values are matched to attributes by name, so one secret can never be displayed under another attribute's label.
• Plan files are written to a private temporary directory (mode 0700) and deleted when the plan is superseded, applied, or the program exits. They are never written into your Terraform directory, where they could be committed by accident.
• A plan is discarded once applied, so a stale plan cannot be applied twice.
• tftui never invokes a shell. Terraform is executed directly with an argument list, so resource addresses containing quotes, spaces or $ are safe.

Usage tracking

• tftui uses PostHog to understand how the tool is used.
• No personal data is sent. Returning users are identified by a two-word handle derived from a one-way hash of the machine name.
• Crash reports have directory names stripped out before they are sent.
• Tracking never blocks the UI and never takes the application down.
• Opt out with -d, or turn off every outbound call — tracking and the update check alike — with -o.

Contributing

See CONTRIBUTING.md. In short:

make setup     # install dependencies and git hooks
make check     # lint, type-check and test
make run       # run against the bundled example project

Changelog

See CHANGELOG.md.

Star history