Improve terraform console to be able to do things under a locked state file context.

[gtmtech]

Terraform Version

1.3.0

Use Cases

Many times on a terraform journey I want to refactor things. Perhaps have a new way of organising state, perhaps I need to onboard new clients and have to import hundreds of resources.

For such cases, terraform currently has very primitive mechanisms, including terraform state mv that can move a single item of state and terraform import that can import a single item at a time.

I am grateful for these but they dont cut the mustard at large-scale usecases. As an example I am currently working on a project where I have to import over 100k resources. It takes so long to do (measured in months) that its actually quicker for me to learn how the state file is written and write a program to make the state up myself.

I was thinking - why doesnt the console provide access to be able to manipulate state through console commands? Why can't I for example lock the statefile, then issue a lot of state mv commands, and then issue some import commands and then unlock the statefile all from the comfort of the terraform console.

Doing so would make it a lot easier to handle these bulk scenarios because the full state lock/unlock // initialise // module download process and any other boilerplate stuff only needs to happen once, not lots of times.

Besides - what is the console actually for right now? It just seems a place to try out go functions - it doesn't seem to offer any useful functionality other than checking what data a variable holds, or seeing what the theoretical output of a function is.

Attempted Solutions

I wrote my own terraform state manipulator - but I shouldn't have to do this.

Proposal

Proposal is above. I would like to see commands in the console like:

lock state
unlock state
mv module.foo module.bar
import aws_instance.foo i-12345678

Alternatively if console already locks the state when starting (IIRC it does), then no need for lock/unlock state, just the state manipulation commands as part of this

References

#22227
#22219

[kmoe]

The only thing terraform console does is evaluate expressions: this is the intention behind the command. It's a debugging tool to look up values and expressions.

That said, the use case you describe - "Why can't I for example lock the statefile, then issue a lot of state mv commands, and then issue some import commands and then unlock the statefile" - is quite a common one, with a number of approaches outside terraform console, which would need to be rewritten to a considerable degree to allow this.

As @jbardin has said elsewhere, the Terraform CLI is not intended to coordinate other instances of the Terraform CLI: process coordination must happen outside Terraform. You are correct that terraform console already locks the state; it is not the only command that does so.

I suspect that solving the bulk import problem (described by the issues you linked) would alleviate much of the pain described here - if bulk import were supported, would there be any benefit to running it via terraform console?