Terraform .gitignore template

State files are the reason this template matters more than most. A state file records the real attributes of every resource the tool manages, and those attributes include values marked sensitive: database passwords, generated keys, connection strings. They are stored in plain text with no encryption whatsoever. A committed state file is a credential dump, not a configuration artefact.

The rules cover *.tfstate and *.tfstate.*, the second of which catches the numbered backups written before each apply. The right home for state is a remote backend with encryption and locking, which also solves the problem of two people applying at once. The ignore rule is the local fallback for the period before that backend is configured.

*.tfvars and *.tfvars.json are the variable files, and they are ignored for the same reason: they are where people put the secrets that the configuration reads. That creates a real tension, because a project usually wants a shared, non secret variable file for each environment. The usual resolution is to name those files something that does not end in .tfvars, or to add an explicit negation for the ones you track.

**/.terraform/* is the plugin and module directory, holding downloaded providers, which are large platform specific binaries, and cached copies of remote modules. It is regenerated by an init command and there is no reason to carry it. Provider binaries are tens of megabytes each and are downloaded for the platform running the command, so a copy from a colleague's machine is often the wrong architecture entirely.

The override rules are the interesting design detail. A file named override.tf or ending in _override.tf is merged over the main configuration automatically, which makes it the mechanism for a local change you do not want to share. Ignoring them is what turns that mechanism into a safe one.