The TF_LOG environment variable is a powerful debugging tool in Terraform that controls the verbosity of logging output during Terraform operations. Understanding this variable is essential for the Terraform Associate certification as it helps troubleshoot issues and understand Terraform's internal…The TF_LOG environment variable is a powerful debugging tool in Terraform that controls the verbosity of logging output during Terraform operations. Understanding this variable is essential for the Terraform Associate certification as it helps troubleshoot issues and understand Terraform's internal behavior.
TF_LOG accepts several log levels, listed from most to least verbose: TRACE, DEBUG, INFO, WARN, and ERROR. TRACE provides the most detailed output, showing every step Terraform takes during execution, while ERROR only displays critical issues that prevent operations from completing.
To enable logging, you set the environment variable before running Terraform commands. On Linux or macOS, use: export TF_LOG=DEBUG. On Windows PowerShell, use: $env:TF_LOG="DEBUG". Once set, Terraform outputs detailed logs to stderr during plan, apply, or other operations.
For persistent log storage, combine TF_LOG with TF_LOG_PATH. This companion variable specifies a file path where Terraform writes log output. For example: export TF_LOG_PATH="./terraform.log". This approach is valuable when you need to review logs later or share them for troubleshooting purposes.
Starting with Terraform 0.15, you can also use TF_LOG_CORE and TF_LOG_PROVIDER to set different log levels for Terraform core functionality versus provider plugins. This granular control helps isolate whether issues originate from Terraform itself or from specific provider implementations.
To disable logging, unset the variable or set it to an empty string. On Linux/macOS: unset TF_LOG or export TF_LOG="". On Windows: Remove-Item Env:TF_LOG.
Common use cases include debugging provider authentication failures, understanding resource dependency resolution, investigating state file operations, and troubleshooting module behavior. When preparing for certification, remember that TRACE level logging can expose sensitive information, so handle log files securely and avoid committing them to version control systems.
TF_LOG Environment Variable - Complete Guide
What is TF_LOG?
TF_LOG is an environment variable in Terraform that enables detailed logging for debugging purposes. When set, Terraform outputs verbose logs that help you understand what Terraform is doing behind the scenes during operations like plan, apply, or destroy.
Why is TF_LOG Important?
Understanding TF_LOG is crucial for several reasons:
• Troubleshooting: When Terraform operations fail or behave unexpectedly, logs help identify the root cause • Understanding API Calls: You can see the actual API requests Terraform makes to providers • Performance Analysis: Logs reveal timing information that helps optimize configurations • Provider Issues: Helps diagnose problems with specific providers or resources
How TF_LOG Works
TF_LOG accepts the following log levels (from most to least verbose):
• TRACE - Most detailed logging, includes all internal steps • DEBUG - Detailed debugging information • INFO - General operational information • WARN - Warning messages only • ERROR - Error messages only
Setting TF_LOG:
On Linux/macOS: export TF_LOG=DEBUG
On Windows (PowerShell): $env:TF_LOG="DEBUG" On Windows (CMD): set TF_LOG=DEBUG
TF_LOG_PATH Environment Variable
By default, logs are sent to stderr. To persist logs to a file, use TF_LOG_PATH:
This writes all log output to the specified file instead of the console.
TF_LOG_CORE and TF_LOG_PROVIDER
For more granular control, Terraform offers:
• TF_LOG_CORE - Sets log level for Terraform core functionality • TF_LOG_PROVIDER - Sets log level for provider plugins
These allow you to debug specific components. For example, set TF_LOG_PROVIDER=TRACE to get detailed provider logs while keeping core logs quiet.
Disabling Logging
To turn off logging, unset the variable or set it to an empty value:
unset TF_LOG
Exam Tips: Answering Questions on TF_LOG Environment Variable
1. Memorize the Log Levels: Remember the five levels - TRACE, DEBUG, INFO, WARN, ERROR. TRACE is the most verbose.
2. Know TF_LOG_PATH: Questions often ask how to save logs to a file. The answer is TF_LOG_PATH, not a command-line flag.
3. Understand Default Behavior: Logs go to stderr by default, not stdout or a file.
4. Remember TRACE for Maximum Detail: If a question asks about the most detailed or verbose logging, the answer is TRACE, not DEBUG.
5. Environment Variables Only: Terraform logging is controlled through environment variables, not through configuration files or CLI flags.
6. Provider vs Core Logging: Know that TF_LOG_CORE and TF_LOG_PROVIDER exist for separate control of different Terraform components.
7. Common Exam Scenarios: - "How do you enable debugging?" → Set TF_LOG environment variable - "Where do logs go by default?" → stderr - "How to write logs to a file?" → Set TF_LOG_PATH - "Most verbose log level?" → TRACE
8. Case Sensitivity: The log level values are case-insensitive in practice, but exam answers typically show them in uppercase.