Terraform .gitignore Template
Terraform state files (`*.tfstate`) contain sensitive unencrypted secrets (passwords, TLS private keys, IAM tokens). Leaking tfstate files is one of the leading causes of cloud security breaches.
| 1 | # Local .terraform directory (provider plugins & modules) |
| 2 | **/.terraform/* |
| 3 | |
| 4 | # .tfstate files contain raw unencrypted secrets! |
| 5 | *.tfstate |
| 6 | *.tfstate.* |
| 7 | |
| 8 | # Crash log files |
| 9 | crash.log |
| 10 | crash.*.log |
| 11 | |
| 12 | # Exclude all variable files with potential secrets |
| 13 | *.tfvars |
| 14 | *.tfvars.json |
| 15 | |
| 16 | # Ignore override files |
| 17 | override.tf |
| 18 | override.tf.json |
| 19 | *_override.tf |
| 20 | *_override.tf.json |
| 21 | |
| 22 | # Include fake test vars if desired |
| 23 | !example.tfvars |
| 24 | |
| 25 | # CLI configuration files |
| 26 | .terraformrc |
| 27 | terraform.rc |
Key Rules & Why They Are Ignored
*.tfstate & *.tfstate.*CRITICAL SECURITY: Unencrypted state files containing cloud passwords, private keys, and resource IDs.
**/.terraform/*Downloaded cloud provider plugins (AWS, Azure, GCP) taking up hundreds of megabytes.
*.tfvarsVariable definition files often containing production API keys and database credentials.
Already Committed Ignored Files? Purge from Git Cache
Adding a pattern to .gitignore does NOT delete files that were already tracked in previous commits. Run this command to remove them from tracking without deleting your local copies:
git rm -r --cached . && git add . && git commit -m "Untrack ignored files"Frequently Asked Questions About Terraform .gitignore
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
Store state in a secure remote backend with encryption at rest and locking, such as an AWS S3 bucket with DynamoDB locking, Terraform Cloud, or Google Cloud Storage.