Terraform の状態ファイルは、Terraform の構成と Google Cloud リソース間のマッピングを維持するために重要です。破損があると、インフラストラクチャに大きな問題が発生する可能性があります。Terraform の状態の変更が必要な場合は、terraform state コマンドを使用します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eAlways generate and review a Terraform plan before applying it, even during local development, and automate the execution of plans through a CI/CD pipeline.\u003c/p\u003e\n"],["\u003cp\u003eUtilize service account credentials through workload identity federation for CI/CD pipelines running outside of Google Cloud, and avoid downloading service account keys.\u003c/p\u003e\n"],["\u003cp\u003eAvoid importing existing resources whenever possible; instead, create new resources through Terraform to maintain clear resource management, and use the \u003ccode\u003eterraform import\u003c/code\u003e command with explicit approval if deletion of resources is not feasible.\u003c/p\u003e\n"],["\u003cp\u003eRefrain from manually modifying the Terraform state file, instead using the \u003ccode\u003eterraform state\u003c/code\u003e command for any necessary state adjustments.\u003c/p\u003e\n"],["\u003cp\u003eRegularly review version pins for Terraform, its providers, and modules, and consider automating this with a tool such as Dependabot.\u003c/p\u003e\n"]]],[],null,["# Best practices for Terraform operations\n\nThis document provides guidelines and recommendations for Terraform operations.\n\nThis guide is not an introduction to Terraform. For an introduction to using\nTerraform with Google Cloud, see\n[Get started with Terraform](/docs/terraform/get-started-with-terraform).\n\nAlways plan first\n-----------------\n\nAlways generate a plan first for Terraform executions.\n[Save the plan to an output file](https://learn.hashicorp.com/tutorials/terraform/automate-terraform).\nAfter an infrastructure owner approves it, execute the plan. Even when\ndevelopers are locally prototyping changes, they should generate a plan and\nreview the resources to be added, modified, and destroyed before applying the\nplan.\n\nImplement an automated pipeline\n-------------------------------\n\nTo ensure consistent execution context, execute Terraform through automated\ntooling. If a build system (like Jenkins) is already in use and widely adopted,\nuse it to run the `terraform plan` and `terraform apply` commands automatically.\nIf no existing system is available, adopt either\n[Cloud Build](/docs/terraform/resource-management/managing-infrastructure-as-code)\nor\n[Terraform Cloud](https://cloud.hashicorp.com/products/terraform).\n\nUse service account credentials for continuous integration\n----------------------------------------------------------\n\nWhen Terraform is executed from a machine in a CI/CD pipeline, it should\ninherit the service account credentials from the service executing the pipeline.\nWherever possible, run CI pipelines on Google Cloud because\nCloud Build, Google Kubernetes Engine, or Compute Engine inject credentials\nwithout downloading service account keys.\n\nFor pipelines that run outside of Google Cloud, prefer\n[workload identity federation](/iam/docs/using-workload-identity-federation)\nto obtain credentials without downloading service account keys.\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nAvoid importing existing resources\n----------------------------------\n\nWhere possible, avoid importing existing resources\n(using [`terraform import`](https://www.terraform.io/cli/import)), because doing\nso can make it challenging to fully understand the provenance and configuration\nof manually created resources. Instead, create new resources through Terraform\nand delete the old resources.\n\nIn cases where deleting old resources would create significant toil,\nuse the `terraform import` command with explicit approval. After a resource is\nimported into Terraform, manage it exclusively with Terraform.\n\nGoogle provides a tool that you can use to import your\nGoogle Cloud resources into Terraform state. For more information,\nsee [Import your Google Cloud resources into Terraform\nstate](/docs/terraform/resource-management/import).\n\nDon't modify Terraform state manually\n-------------------------------------\n\nThe Terraform state file is critical for maintaining the mapping between\nTerraform configuration and Google Cloud resources. Corruption can lead\nto major infrastructure problems. When modifications to the Terraform state are\nnecessary, use the [`terraform state`](https://www.terraform.io/cli/state)\ncommand.\n\nRegularly review version pins\n-----------------------------\n\nPinning versions ensures stability but prevents bug fixes and other\nimprovements from being incorporated into your configuration. Therefore,\nregularly review version pins for Terraform, Terraform providers, and modules.\n\nTo automate this process, use a tool such as\n[Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates#supported-repositories-and-ecosystems).\n\nUse application default credentials when running locally\n--------------------------------------------------------\n\nWhen developers are locally iterating on Terraform configuration, they should\nauthenticate by running\n[`gcloud auth application-default login`](https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login)\nto generate application default credentials. Don't download service account\nkeys, because downloaded keys are harder to manage and secure.\n\nSet aliases to Terraform\n------------------------\n\nTo make local development easier, you can add aliases to your command shell\nprofile:\n\n- `alias tf=\"terraform\"`\n- `alias terrafrom=\"terraform\"`\n\nWhat's next\n-----------\n\n- Learn about [best practices to securely use Terraform](/docs/terraform/best-practices/security).\n- Learn about [best practices for testing Terraform modules and configurations](/docs/terraform/best-practices/testing)."]]
