<p>No, unfortunately, <strong>Terraform</strong> doesn't have the feature to apply <strong>a specific .tf file</strong>. <strong>Terraform</strong> applies <strong>all .tf files</strong> in the same directory.</p>
<p>But you can apply <strong>the specific code</strong> with <strong>comment out</strong> and <strong>uncomment</strong>. For example, you have 2 .tf files <strong>&quot;1st.tf&quot;</strong> and <strong>&quot;2nd.tf&quot;</strong> in the same directory to create the resources for <strong>GCP(Google Cloud Platform)</strong>:</p>
<p><a href="https://i.sstatic.net/LwF1P.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/LwF1P.png" alt="enter image description here" /></a></p>
<p>Then, <strong>&quot;1st.tf&quot;</strong> has this code below:</p>
<pre class="lang-js prettyprint-override"><code>provider &quot;google&quot; {
  credentials = file(&quot;myCredentials.json&quot;)
  project     = &quot;myproject-113738&quot;
  region      = &quot;asia-northeast1&quot;
}

resource &quot;google_project_service&quot; &quot;project&quot; {
  service = &quot;iam.googleapis.com&quot;
  disable_dependent_services = true
}
</code></pre>
<p>And <strong>&quot;2nd.tf&quot;</strong> has this code below:</p>
<pre class="lang-js prettyprint-override"><code>resource &quot;google_service_account&quot; &quot;service_account_1&quot; {
  display_name = &quot;Service Account 1&quot;
  account_id   = &quot;service-account-1&quot;
}

resource &quot;google_service_account&quot; &quot;service_account_2&quot; {
  display_name = &quot;Service Account 2&quot;
  account_id   = &quot;service-account-2&quot;
}
</code></pre>
<p>Now, first, you want to only apply the code in <strong>&quot;1st.tf&quot;</strong> so you need to <strong>comment out</strong> the code in <strong>&quot;2nd.tf&quot;</strong>:</p>
<p><strong>1st.tf</strong>:</p>
<pre class="lang-js prettyprint-override"><code>provider &quot;google&quot; {
  credentials = file(&quot;myCredentials.json&quot;)
  project     = &quot;myproject-113738&quot;
  region      = &quot;asia-northeast1&quot;
}

resource &quot;google_project_service&quot; &quot;project&quot; {
  service = &quot;iam.googleapis.com&quot;
  disable_dependent_services = true
}
</code></pre>
<p><strong>2nd.tf (Comment Out)</strong>:</p>
<pre class="lang-py prettyprint-override"><code># resource &quot;google_service_account&quot; &quot;service_account_1&quot; {
#   display_name = &quot;Service Account 1&quot;
#   account_id   = &quot;service-account-1&quot;
# }

# resource &quot;google_service_account&quot; &quot;service_account_2&quot; {
#   display_name = &quot;Service Account 2&quot;
#   account_id   = &quot;service-account-2&quot;
# }
</code></pre>
<p>Then, you apply:</p>
<pre class="lang-html prettyprint-override"><code>terraform apply -auto-approve
</code></pre>
<p>Next, additionally, you want to apply the code in <strong>&quot;2nd.tf&quot;</strong> so you need to <strong>uncomment</strong> the code in <strong>&quot;2nd.tf&quot;</strong>:</p>
<p><strong>1st.tf</strong>:</p>
<pre class="lang-js prettyprint-override"><code>provider &quot;google&quot; {
  credentials = file(&quot;myCredentials.json&quot;)
  project     = &quot;myproject-113738&quot;
  region      = &quot;asia-northeast1&quot;
}

resource &quot;google_project_service&quot; &quot;project&quot; {
  service = &quot;iam.googleapis.com&quot;
  disable_dependent_services = true
}
</code></pre>
<p><strong>2nd.tf (Uncomment)</strong>:</p>
<pre class="lang-py prettyprint-override"><code>resource &quot;google_service_account&quot; &quot;service_account_1&quot; {
  display_name = &quot;Service Account 1&quot;
  account_id   = &quot;service-account-1&quot;
}

resource &quot;google_service_account&quot; &quot;service_account_2&quot; {
  display_name = &quot;Service Account 2&quot;
  account_id   = &quot;service-account-2&quot;
}
</code></pre>
<p>Then, you apply:</p>
<pre class="lang-html prettyprint-override"><code>terraform apply -auto-approve
</code></pre>
<p>This way, you can apply <strong>the specific code</strong> with <strong>comment out</strong> and <strong>uncomment</strong>.</p>

CC BY-SA 4.0
2022-02-01T01:48:13.070Z
Welcome to DevOps.SE.  How is this method better than the accepted answer here?
chicks
CC BY-SA 4.0
2022-03-29T14:48:14.733Z
I would not recommend commenting and uncommenting since it violates infrastructure as a code approach, thereby developers end up in a situation where `*.tf` specification differs from real state
Nick Roz
CC BY-SA 4.0
2022-01-31T23:57:36.673Z
2022-01-31T23:57:36.673Z
Super Kai - Kazuya Ito
<p>Using terraform module is preferred, but if you really have to run terraform apply against a single file, I made this bash script to generate terraform apply command against all targets and modules in one file:</p>

<pre class="lang-sh prettyprint-override"><code>#!/usr/bin/env bash
if [[ -z "$@" ]]; then
  echo "Missing file input arguments"
  exit 1
fi

echo "terraform apply \\"
for FILE in "$@"
do
  RESOURCE=$(sed -n 's/resource "\([^"]*\)" "\([^"]*\)".*/-target=\1.\2 \\/gp' $FILE)
  MODULE=$(sed -n 's/module "\([^"]*\)".*/-target=module.\1 \\/gp' $FILE)
  if [[ -z "$RESOURCE" ]] &amp;&amp; [[ -z "$MODULE" ]]; then
    echo "Cannot detect terraform resource and module in $FILE"
    exit 1
  fi

  if [[ ! -z "$RESOURCE" ]]; then
    echo -e $"$RESOURCE"
  fi
  if [[ ! -z "$MODULE" ]]; then
    echo -e $"$MODULE"
  fi
done
echo "-refresh=true"
</code></pre>

<p>I'm not really a bash expert, but it was tested to work on Mac.</p>

<p>EDIT: The sed command assumes that the resources and modules are formatted nicely according to <code>terraform fmt</code> like so:</p>

<pre class="lang-sh prettyprint-override"><code>resource "aws_eip" "my_public_ip" {
}

resource "aws_instance" "my_server" {
}

module "my_module" {
}
</code></pre>

CC BY-SA 4.0
2019-08-24T02:03:55.667Z
2020-04-03T14:00:12.217Z
2020-04-03T14:00:12.217Z
Permagate
<p>If you organize your code by modules, you could apply terraform only on a module, eg :</p>

<pre><code># securitygroup.tf
module "securitygroup" {
  source = "git@github.com:user/securitygroup-terraform-module.git?ref=master"
}

$ tf apply -target=module.securitygroup
</code></pre>

CC BY-SA 4.0
2019-05-21T08:20:32.847Z
2019-05-21T08:20:32.847Z
Antoine
<p>Doesn't look like it's possible. <a href="https://github.com/hashicorp/terraform/blob/master/config/import_tree.go" rel="nofollow noreferrer">Here is the code</a> to load config files and it loads all *.tf files from current directory (or a specified one) and there is nothing there to limit the configuration to a single file.</p>

CC BY-SA 4.0
2023-11-14T22:08:42.653Z
Other answers are here which show how this is possible.  At least one of them was here before you posted your answer.  Do you stand by this answer?
chicks
CC BY-SA 4.0
2018-06-13T13:10:29.160Z
2018-06-13T13:10:29.160Z
rush
<p>Not really. The standard way to work around this though is to use eg:</p>
<pre><code>terraform apply -target=aws_security_group.my_sg
</code></pre>
<p>but that's only going to apply one security group at a time, so will get tedious if you have a lot of them. You can, however, target multiple resources in one command:</p>
<pre><code>terraform apply -target=aws_security_group.my_sg -target=aws_security_group.my_2nd_sg
</code></pre>
<p>However, there are potentially a couple of workarounds:</p>
<ul>
<li><p><strong>The <code>-target</code> parameter respects dependencies.</strong></p>
<p>This means if you were to eg. <code>-target=aws_instance.my_server</code> and that instance had, say, five security groups attached to it via interpolation, changes to those security groups <em>should</em> be included in the plan (I haven't thoroughly tested this, but I believe this is how it works).</p>
<p>That is a bit messy though, as you probably don't want to touch an instance. A safer alternative might be using something like a <a href="https://www.terraform.io/docs/provisioners/null_resource.html" rel="noreferrer"><code>null_resource</code></a> to provide a target for the security groups, but again I haven't tried this (there might be another 'safe' resource you could rely on, though?).
<br /><br /></p>
</li>
<li><p><strong>Create a module.</strong></p>
<p>You can target a <a href="https://www.terraform.io/docs/configuration-0-11/modules.html" rel="noreferrer">module</a> just like you can target a plain resource (be sure to include the quotes around the target name):</p>
<pre><code> terraform apply -target=&quot;module.my_security_groups&quot;
</code></pre>
<p>Inside this module, you could define all of your security groups - just like you would have outside of the module. As well as being able to target it directly, this also makes it easier for you to re-use the same set of security groups for other infrastructure, if you ever need to.</p>
</li>
</ul>

CC BY-SA 4.0
2020-08-17T08:13:29.750Z
`terraform state list` is a great way to find the available resources
Federico
CC BY-SA 4.0
2018-06-17T02:45:03.080Z
2022-07-12T17:02:15.867Z
2022-07-12T17:02:15.867Z
Tim Malone
<p>I have my security groups in a <code>securitygroup.tf</code> file.</p>

<p>In the same dir there are plenty of other resource descriptions (rds, ec2 etc).</p>

<p>Is there a way to perform a <code>terraform apply --auto-approve</code> <strong>only</strong> for my <code>securitygroups.tf</code>?</p>

<terraform>
Terraform: apply only one tf file
pkaramol
# Terraform: apply only one tf file

(Asked by: username_0 on 2018-06-13)

I have my security groups in a `securitygroup.tf` file.

In the same dir there are plenty of other resource descriptions (rds, ec2 etc).

Is there a way to perform a `terraform apply --auto-approve` **only** for my `securitygroups.tf`?

**Tags:** terraform


---

## 5 answers

### Answer by username_7 on 2018-06-17. Score: 60 | Accepted answer

Not really. The standard way to work around this though is to use eg:
terraform apply -target=aws_security_group.my_sg

but that's only going to apply one security group at a time, so will get tedious if you have a lot of them. You can, however, target multiple resources in one command:
terraform apply -target=aws_security_group.my_sg -target=aws_security_group.my_2nd_sg

However, there are potentially a couple of workarounds:

The -target parameter respects dependencies.
This means if you were to eg. -target=aws_instance.my_server and that instance had, say, five security groups attached to it via interpolation, changes to those security groups should be included in the plan (I haven't thoroughly tested this, but I believe this is how it works).
That is a bit messy though, as you probably don't want to touch an instance. A safer alternative might be using something like a null_resource to provide a target for the security groups, but again I haven't tried this (there might be another 'safe' resource you could rely on, though?).


Create a module.
You can target a module just like you can target a plain resource (be sure to include the quotes around the target name):
 terraform apply -target="module.my_security_groups"

Inside this module, you could define all of your security groups - just like you would have outside of the module. As well as being able to target it directly, this also makes it easier for you to re-use the same set of security groups for other infrastructure, if you ever need to.

> **Comments:**
> **username_8**: `terraform state list` is a great way to find the available resources  

---

### Answer by username_5 on 2019-05-21. Score: 15

If you organize your code by modules, you could apply terraform only on a module, eg :
# securitygroup.tf
module "securitygroup" {
  source = "git@github.com:user/securitygroup-terraform-module.git?ref=master"
}

$ tf apply -target=module.securitygroup


---

### Answer by username_1 on 2022-01-31. Score: 3

No, unfortunately, Terraform doesn't have the feature to apply a specific .tf file. Terraform applies all .tf files in the same directory.
But you can apply the specific code with comment out and uncomment. For example, you have 2 .tf files "1st.tf" and "2nd.tf" in the same directory to create the resources for GCP(Google Cloud Platform):

Then, "1st.tf" has this code below:
provider "google" {
  credentials = file("myCredentials.json")
  project     = "myproject-113738"
  region      = "asia-northeast1"
}

resource "google_project_service" "project" {
  service = "iam.googleapis.com"
  disable_dependent_services = true
}

And "2nd.tf" has this code below:
resource "google_service_account" "service_account_1" {
  display_name = "Service Account 1"
  account_id   = "service-account-1"
}

resource "google_service_account" "service_account_2" {
  display_name = "Service Account 2"
  account_id   = "service-account-2"
}

Now, first, you want to only apply the code in "1st.tf" so you need to comment out the code in "2nd.tf":
1st.tf:
provider "google" {
  credentials = file("myCredentials.json")
  project     = "myproject-113738"
  region      = "asia-northeast1"
}

resource "google_project_service" "project" {
  service = "iam.googleapis.com"
  disable_dependent_services = true
}

2nd.tf (Comment Out):
# resource "google_service_account" "service_account_1" {
#   display_name = "Service Account 1"
#   account_id   = "service-account-1"
# }

# resource "google_service_account" "service_account_2" {
#   display_name = "Service Account 2"
#   account_id   = "service-account-2"
# }

Then, you apply:
terraform apply -auto-approve

Next, additionally, you want to apply the code in "2nd.tf" so you need to uncomment the code in "2nd.tf":
1st.tf:
provider "google" {
  credentials = file("myCredentials.json")
  project     = "myproject-113738"
  region      = "asia-northeast1"
}

resource "google_project_service" "project" {
  service = "iam.googleapis.com"
  disable_dependent_services = true
}

2nd.tf (Uncomment):
resource "google_service_account" "service_account_1" {
  display_name = "Service Account 1"
  account_id   = "service-account-1"
}

resource "google_service_account" "service_account_2" {
  display_name = "Service Account 2"
  account_id   = "service-account-2"
}

Then, you apply:
terraform apply -auto-approve

This way, you can apply the specific code with comment out and uncomment.

> **Comments:**
> **username_2**: Welcome to DevOps.SE.  How is this method better than the accepted answer here?  
> **username_3**: I would not recommend commenting and uncommenting since it violates infrastructure as a code approach, thereby developers end up in a situation where `*.tf` specification differs from real state  

---

### Answer by username_4 on 2019-08-24. Score: 2

Using terraform module is preferred, but if you really have to run terraform apply against a single file, I made this bash script to generate terraform apply command against all targets and modules in one file:
#!/usr/bin/env bash
if [[ -z "$@" ]]; then
  echo "Missing file input arguments"
  exit 1
fi

echo "terraform apply \\"
for FILE in "$@"
do
  RESOURCE=$(sed -n 's/resource "\([^"]*\)" "\([^"]*\)".*/-target=\1.\2 \\/gp' $FILE)
  MODULE=$(sed -n 's/module "\([^"]*\)".*/-target=module.\1 \\/gp' $FILE)
  if [[ -z "$RESOURCE" ]] && [[ -z "$MODULE" ]]; then
    echo "Cannot detect terraform resource and module in $FILE"
    exit 1
  fi

  if [[ ! -z "$RESOURCE" ]]; then
    echo -e $"$RESOURCE"
  fi
  if [[ ! -z "$MODULE" ]]; then
    echo -e $"$MODULE"
  fi
done
echo "-refresh=true"

I'm not really a bash expert, but it was tested to work on Mac.
EDIT: The sed command assumes that the resources and modules are formatted nicely according to terraform fmt like so:
resource "aws_eip" "my_public_ip" {
}

resource "aws_instance" "my_server" {
}

module "my_module" {
}


---

### Answer by username_6 on 2018-06-13. Score: 1

Doesn't look like it's possible. [Here is the code](https://github.com/hashicorp/terraform/blob/master/config/import_tree.go) to load config files and it loads all \*.tf files from current directory (or a specified one) and there is nothing there to limit the configuration to a single file.

> **Comments:**
> **username_2**: Other answers are here which show how this is possible.  At least one of them was here before you posted your answer.  Do you stand by this answer?  

---

