github/gitignore · Terraform.gitignore
Terraform .gitignore Template Explained
Why Terraform.gitignore ignores the .terraform folder, tfstate, tfvars, override files and CLI config, and why .terraform.lock.hcl must be committed.
Terraform.gitignore focuses on keeping state and secrets from leaking in infrastructure-as-code repositories. Terraform state files store resource attributes in plain text and can include database passwords or keys.
This template does not ignore .terraform.lock.hcl. HashiCorp advises including this dependency lock file in version control.
Rules explained
| Pattern | What it ignores and why |
|---|---|
.terraform/ | Local working directoryContains the provider binaries and modules downloaded by terraform init, plus backend configuration. The binaries are OS-specific, so they cannot be shared, and they are large. |
*.tfstate*.tfstate.*.terraform.tfstate.lock.info | State filesFiles that record the mapping between real infrastructure and code. Sensitive information is stored in plain text, and when several people each keep their own copy, the state drifts apart. Keep state in a remote backend such as S3 or Terraform Cloud and enable locking. |
*.tfvars*.tfvars.json | Variable value filesFiles containing per-environment values and secrets. The template comments also say they are likely to contain passwords or private keys. |
override.tfoverride.tf.json*_override.tf*_override.tf.json | Override filesFiles that temporarily override resource configuration locally. To commit one, restore it with a form such as !example_override.tf, as the template comments show. |
crash.logcrash.*.log | Crash logsLogs Terraform leaves when it terminates abnormally; they can include configuration contents. |
.terraformrcterraform.rc | CLI configurationCLI configuration files, which can contain a Terraform Cloud authentication token. |
Practical notes
- Commit
.terraform.lock.hcl. That way everyone initializes with the same provider versions and hashes. - Keep shared default variables in
defaultvalues invariables.tfor in an example file (terraform.tfvars.example) rather than in*.auto.tfvars. The*.tfvarsrule does not ignore files ending in.example. - Plan files created with
terraform plan -out=tfplanalso contain sensitive information, so it is safer to add a*tfplan*rule as the template comments suggest. - If a state file was already committed, remove it from the repository and also rotate every secret it contained.
Original template
Terraform.gitignore
# Local .terraform directories.terraform/# .tfstate files*.tfstate*.tfstate.*# Crash log filescrash.logcrash.*.log# Exclude all .tfvars files, which are likely to contain sensitive data, such as# password, private keys, and other secrets. These should not be part of version# control as they are data points which are potentially sensitive and subject# to change depending on the environment.*.tfvars*.tfvars.json# Ignore override files as they are usually used to override resources locally and so# are not checked inoverride.tfoverride.tf.json*_override.tf*_override.tf.json# Ignore transient lock info files created by terraform apply.terraform.tfstate.lock.info# Include override files you do wish to add to version control using negated pattern# !example_override.tf# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan# example: *tfplan*# Ignore CLI configuration files.terraformrcterraform.rc# Optional: ignore graph output files generated by `terraform graph`# *.dot# Optional: ignore plan files saved before destroying Terraform configuration# Uncomment the line below if you want to ignore planout files.# planout
Templates from github/gitignore/Terraform.gitignore @356fd7b (2026-09-11) · CC0-1.0