Enable debugging terraform

By default, a terraform plan or apply run only shows the resources to create, update or delete. It doesn’t give much detail on the activity terraform is doing behind the scene. All the debug logging would especially be helpful when you encounter an error.

Here is a typical terraform plan output, in this case it is a code for creating a firewall rule in Google cloud platform(GCP) – 

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
...
------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

# google_compute_firewall.glb-allow will be created
  + resource "google_compute_firewall" "glb-allow" {
      + creation_timestamp = (known after apply)
      + description        = "Allow GLB proxies"
      + destination_ranges = (known after apply)
      + direction          = (known after apply)
      + id                 = (known after apply)
      + name               = "allow-glb-access"
      + network            = "internal"
      + priority           = 1000
      + project            = "my-gcp-project"
      + self_link          = (known after apply)
      + source_ranges      = [
          + "130.211.0.0/22",
          + "35.191.0.0/16",
        ]
      + target_tags        = [
          + "webservers",
        ]

      + allow {
          + ports    = [
              + "80",
              + "443",
              + "8080",
              + "8443",
            ]
          + protocol = "tcp"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Terraform supports an environment variable – TF_LOG – for detailed logging purposes. You can set the logging to different severity levels which includes – TRACE, DEBUG, INFO, WARN, and ERROR 

$ TF_LOG=DEBUG terraform plan
2020/03/20 17:03:39 [WARN] Log levels other than TRACE are currently unreliable, and are supported only for backward compatibility.
  Use TF_LOG=TRACE to see Terraform's internal logs.
  ----
2020/03/20 17:03:39 [INFO] Terraform version: 0.12.20  
2020/03/20 17:03:39 [INFO] Go runtime version: go1.12.13
2020/03/20 17:03:39 [INFO] CLI args: []string{"/usr/local/bin/terraform", "plan"}
2020/03/20 17:03:39 [DEBUG] Attempting to open CLI config file: /home/daniel/.terraformrc
2020/03/20 17:03:39 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2020/03/20 17:03:39 [INFO] CLI command args: []string{"plan"}
2020/03/20 17:03:39 [DEBUG] checking for provider in "." 
2020/03/20 17:03:39 [DEBUG] checking for provider in "/usr/local/bin"
2020/03/20 17:03:39 [DEBUG] checking for provider in ".terraform/plugins/linux_amd64"
2020/03/20 17:03:39 [DEBUG] found provider "terraform-provider-google_v3.13.0_x5"
....

Terraform also supports saving logs to a file with the TF_LOG_PATH environment variable. 

$ TF_LOG=DEBUG TF_LOG_PATH=/tmp/terraform-debug.log terraform plan
...
$ ls -lh /tmp/terraform-debug.log
-rw-r--r-- 1 daniel daniel 15K Mar 20 17:06 /tmp/terraform-debug.log

References

https://www.terraform.io/docs/internals/debugging.html