A layered approach to Terraform troubleshooting, including plan review, state inspection, provider errors, and diagnostic logging.
Start troubleshooting with the narrowest evidence that can explain the issue: read the error, confirm workspace and backend, inspect configuration and the plan, then examine state when the question is what Terraform tracks. Enable verbose logging when those layers do not explain Terraform or provider behavior.
1TF_LOG=DEBUG TF_LOG_PATH=terraform-debug.log terraform plan
Logs can include credentials, request details, or resource values. Do not commit them or paste them into an untrusted system. Remove the environment variable after the diagnostic run and redact before sharing. HashiCorp’s debugging guide documents log levels and safe collection.
Logging does not replace state inspection, plan review, or provider documentation. A malformed resource argument, expired credential, state lock, and provider API error need different remedies; identify the category before escalating diagnostic detail.