How to Install Terraform on Ubuntu 26.04, 24.04 and 22.04

Terraform on Ubuntu needs a predictable package source before the CLI manages real state files or cloud accounts. To install Terraform on Ubuntu Linux with APT-managed updates, use HashiCorp’s signed repository, store it as a DEB822 source file, and prove the CLI with a local-only configuration before adding provider credentials.

The commands target Ubuntu 26.04, 24.04, and 22.04 on architectures where HashiCorp currently publishes Terraform APT packages. The setup keeps HashiCorp’s repository in /etc/apt/sources.list.d/hashicorp.sources instead of creating an extra hashicorp.list file, then covers a no-cloud test, normal updates, and clean removal.

Install Terraform on Ubuntu

HashiCorp’s official Terraform install page publishes the Ubuntu repository, package name, and current release channel. This workflow uses the same repository and signing key but stores the source as /etc/apt/sources.list.d/hashicorp.sources instead of generating the older hashicorp.list layout.

Compare Terraform Package Sources

Use HashiCorp’s APT repository for most Ubuntu systems because it keeps Terraform under APT, supports normal package upgrades, and avoids PATH conflicts with user-local package managers. Homebrew and Snap can install Terraform too, but those sources own their own update and removal paths and should stay separate from the APT setup.

Source or package path	Status here	Update owner	Reader decision
HashiCorp APT repository	Default path, documented end to end.	APT-managed updates from HashiCorp’s repository.	Use for the official Ubuntu package source, DEB822 source layout, and clean repository cleanup.
Homebrew	Boundary only; do not mix it with the APT setup.	Homebrew itself.	Keep it separate if Homebrew on Ubuntu already owns your developer CLI tools.
Snap Store	Rejected as the default path. The Snap Store listing is maintained by Snapcrafters, not HashiCorp’s APT repository.	Snap itself.	Use only when you deliberately prefer the Snap package and accept its classic confinement and publisher boundary.

HashiCorp’s APT repository currently publishes Terraform for amd64, arm64, armhf, i386, and s390x. The DEB822 source setup writes only your system’s current architecture instead of listing every architecture advertised by the repository metadata.

Prepare Ubuntu for the HashiCorp Repository

Refresh APT metadata first, then install the tools needed to download HTTPS resources and convert HashiCorp’s ASCII-armored signing key into an APT keyring.

sudo apt update
sudo apt install ca-certificates curl gpg

These commands use sudo for package and repository changes. If your account cannot use sudo yet, add the account with the guide to add a new user to sudoers on Ubuntu before continuing.

The curl command downloads the key in the next step. If you want a separate reference for download flags, use the curl command guide.

Add the HashiCorp Signing Key

Download HashiCorp’s APT signing key as your normal user, dearmor it locally, then install the finished keyring into /usr/share/keyrings/ with root-owned permissions.

tmp_keyring="$(mktemp -d)"
curl -fsSLo "$tmp_keyring/hashicorp.asc" https://apt.releases.hashicorp.com/gpg
gpg --dearmor --yes -o "$tmp_keyring/hashicorp.gpg" "$tmp_keyring/hashicorp.asc"
sudo install -m 0644 "$tmp_keyring/hashicorp.gpg" /usr/share/keyrings/hashicorp-archive-keyring.gpg
rm -rf "$tmp_keyring"

Verify the fingerprint from the installed keyring. HashiCorp’s security page lists this separate Linux repository signing key for APT and RPM packages.

gpg --quiet --show-keys --with-fingerprint /usr/share/keyrings/hashicorp-archive-keyring.gpg

pub   rsa4096 2023-01-10 [SC] [expires: 2028-01-09]
      798A EC65 4E5C 1542 8C8E  42EE AA16 FCBC A621 E701
uid                      HashiCorp Security (HashiCorp Package Signing) <security+packaging@hashicorp.com>
sub   rsa4096 2023-01-10 [S] [expires: 2028-01-09]

Add the Terraform APT Repository Without a List File

Create a DEB822 source file for the current Ubuntu codename and architecture. The guard stops before writing the source when the system is not one of the supported Ubuntu LTS codenames or when HashiCorp does not publish Terraform for the current architecture.

. /etc/os-release
codename="${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}"
arch="$(dpkg --print-architecture)"
supported=yes

case "$codename" in
  resolute|noble|jammy) ;;
  *) supported=no ;;
esac

case "$arch" in
  amd64|arm64|armhf|i386|s390x) ;;
  *) supported=no ;;
esac

if [ "$supported" = "yes" ]; then
  printf '%s\n' \
    'Types: deb' \
    'URIs: https://apt.releases.hashicorp.com' \
    "Suites: ${codename}" \
    'Components: main' \
    "Architectures: ${arch}" \
    'Signed-By: /usr/share/keyrings/hashicorp-archive-keyring.gpg' \
  | sudo tee /etc/apt/sources.list.d/hashicorp.sources > /dev/null
else
  printf 'HashiCorp Terraform APT packages are not available for Ubuntu codename "%s" on architecture "%s".\n' "$codename" "$arch" >&2
  false
fi

Confirm that Ubuntu has a single HashiCorp DEB822 source file and no new hashicorp.list file from this workflow.

cat /etc/apt/sources.list.d/hashicorp.sources

Types: deb
URIs: https://apt.releases.hashicorp.com
Suites: resolute
Components: main
Architectures: amd64
Signed-By: /usr/share/keyrings/hashicorp-archive-keyring.gpg

Your Suites: line should match your Ubuntu codename, such as resolute, noble, or jammy. Your Architectures: line should match dpkg --print-architecture on that system.

Verify the Terraform Package Candidate

Refresh APT after writing the source file, then confirm that the Terraform candidate comes from HashiCorp’s repository.

sudo apt update
apt-cache policy terraform

The version changes as HashiCorp publishes new Terraform releases, but the source should be https://apt.releases.hashicorp.com for your Ubuntu codename.

terraform:
  Installed: (none)
  Candidate: 1.15.4-1
  Version table:
     1.15.4-1 500
        500 https://apt.releases.hashicorp.com resolute/main amd64 Packages

Install Terraform with APT

Install the terraform package after the candidate source looks correct. The current HashiCorp package depends on git, so APT can install Git during the same transaction when the system does not already have it.

sudo apt install terraform

Verify the installed CLI and binary path.

terraform version
command -v terraform

Terraform v1.15.4
on linux_amd64
/usr/bin/terraform

Test Terraform on Ubuntu Without Cloud Credentials

A version check proves the binary starts, but a small local Terraform project proves that initialization, validation, planning, state handling, and cleanup work together. This test uses Terraform’s built-in terraform_data resource, so it does not download a cloud provider or create external infrastructure.

Create a Local Terraform Test Project

Create a disposable project directory with mkdir under your home folder and write a minimal configuration.

project_dir="$HOME/terraform-smoke-test"
mkdir -p "$project_dir" &&
cd "$project_dir" &&
cat > main.tf <<'EOF'
terraform {
  required_version = ">= 1.4.0"
}

resource "terraform_data" "ubuntu_check" {
  input = "Terraform works on Ubuntu"
}

output "message" {
  value = terraform_data.ubuntu_check.output
}
EOF

Initialize and Validate the Terraform Project

Initialize the working directory first. Terraform reports that the built-in provider is available without downloading a plugin.

terraform init -no-color

Initializing provider plugins found in the configuration...
- terraform.io/builtin/terraform is built in to Terraform

Initializing the backend...

Terraform has been successfully initialized!

Validate the configuration before planning any changes.

terraform validate -no-color

Success! The configuration is valid.

Plan, Apply, and Destroy the Test Resource

Generate a saved plan, apply it, print the output, then destroy the local test state.

The apply command in this test creates only Terraform state for the built-in resource. It does not create cloud servers, DNS records, storage buckets, or files outside the test project directory.

terraform plan -no-color -out=tfplan
terraform apply -no-color -auto-approve tfplan
terraform output -raw message
printf '\n'
terraform destroy -no-color -auto-approve

Relevant output includes the planned state change, the output value, and the final destroy confirmation.

Plan: 1 to add, 0 to change, 0 to destroy.
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
Terraform works on Ubuntu
Destroy complete! Resources: 1 destroyed.

Remove the disposable project directory when you no longer need the smoke test files.

project_dir="$HOME/terraform-smoke-test"
if cd "$HOME"; then
  rm -rf "$project_dir"
else
  printf 'Cannot enter %s\n' "$HOME" >&2
fi
test -d "$project_dir" && echo present || echo removed

removed

Use Terraform After Installation

The Terraform CLI command reference is useful after the package is installed because most real work happens through subcommands such as init, validate, plan, apply, destroy, output, and state.

Read Terraform Help from the Terminal

Start with the built-in help so the command list matches the Terraform version installed on your Ubuntu system.

terraform -help
terraform plan -help

The main commands you will use most often are terraform init to prepare a working directory, terraform validate to check syntax and references, terraform plan to preview changes, terraform apply to make changes, and terraform destroy to remove resources managed by the current state.

Version Terraform Projects with Git

The HashiCorp package installs Git as a dependency when it is missing, but Terraform teams still need deliberate Git setup. Configure your identity or update Git on Ubuntu before you start sharing real Terraform projects with a team.

Do not commit provider credentials, access tokens, private keys, or unreviewed terraform.tfstate files. State files can contain resource identifiers, generated passwords, and provider-returned metadata depending on the providers you use.

Update Terraform on Ubuntu

APT handles Terraform updates while the HashiCorp source remains enabled. Use --only-upgrade when you want to upgrade Terraform on systems where the package is already installed without accidentally installing it on hosts where it is absent.

sudo apt update
sudo apt install --only-upgrade terraform

Check the active version after the upgrade.

terraform version

For broader package maintenance, use the separate guide to update Ubuntu packages from the command line.

Troubleshoot Terraform on Ubuntu

Most Terraform install failures on Ubuntu come from a missing source file, an old duplicate .list file, DNS failures during repository access, or running the wrong Terraform binary from another package manager.

Fix Unable to Locate Package Terraform

If APT cannot find terraform, the HashiCorp source file was not written, the source was not refreshed, or the source guard skipped your release or architecture. A failed install can show this error before the repository state is repaired.

sudo apt install terraform

E: Unable to locate package terraform

Check the source file, refresh APT, and inspect the package candidate again.

cat /etc/apt/sources.list.d/hashicorp.sources
sudo apt update
apt-cache policy terraform

If the file does not exist or the candidate still shows (none), rerun the DEB822 source setup step and confirm that your Ubuntu codename and architecture are supported.

Fix Duplicate HashiCorp Source Files

Older HashiCorp examples and some copied tutorials create /etc/apt/sources.list.d/hashicorp.list. If that file exists beside the DEB822 source file, APT can reject the repository during a metadata refresh because the same source is configured through two different paths.

sudo apt update

E: Conflicting values set for option Signed-By regarding source https://apt.releases.hashicorp.com

List the HashiCorp source files first so you can see the duplicate.

ls /etc/apt/sources.list.d/hashicorp*

If your system uses the DEB822 source named hashicorp.sources, remove the legacy list file and refresh APT.

sudo rm -f /etc/apt/sources.list.d/hashicorp.list
sudo apt update

Confirm that only the DEB822 file remains.

ls /etc/apt/sources.list.d/hashicorp*

/etc/apt/sources.list.d/hashicorp.sources

Fix Terraform Command Path Conflicts

If you previously installed Terraform with Homebrew, Snap, a manual binary, or another tool manager, your shell may run that copy before the APT package. Check the active path before reinstalling.

command -v terraform
terraform version

The HashiCorp APT package installs /usr/bin/terraform. If another path appears first, remove or adjust the older method, open a new terminal, then recheck the path.

Fix Repository or Registry DNS Failures

DNS failures can block the signing-key download, APT repository refresh, or provider downloads during terraform init. Test the hostnames before changing Terraform configuration.

getent hosts apt.releases.hashicorp.com
getent hosts registry.terraform.io

If neither command returns an address, fix name resolution first. The troubleshooting guide for curl could not resolve host errors covers the same DNS layer that affects the HashiCorp key download and provider registry access.

Remove Terraform from Ubuntu

Remove Terraform in phases so package removal, repository cleanup, and project data decisions stay separate. Keep the HashiCorp repository and keyring if you also installed other HashiCorp packages such as Vault, Packer, Consul, or Nomad from the same source.

Purge the Terraform Package

Purge the package when you want both the installed binary and any dpkg residual package record removed.

sudo apt purge terraform

Verify that Terraform is no longer installed and no residual config state remains in dpkg.

dpkg-query -W -f='${db:Status-Abbrev}\n' terraform 2>/dev/null | grep -E '^(ii|rc)' || echo "terraform fully removed"

terraform fully removed

Remove the HashiCorp Repository and Keyring

Run this cleanup only when Terraform was the only package you installed from HashiCorp’s APT repository. It removes the DEB822 source file, a possible older hashicorp.list file, and the repository keyring.

sudo rm -f /etc/apt/sources.list.d/hashicorp.sources
sudo rm -f /etc/apt/sources.list.d/hashicorp.list
sudo rm -f /usr/share/keyrings/hashicorp-archive-keyring.gpg
sudo apt update

Confirm that HashiCorp’s source no longer contributes a Terraform package candidate.

apt-cache policy terraform 2>/dev/null | grep apt.releases.hashicorp.com || echo "HashiCorp Terraform source removed"

HashiCorp Terraform source removed

Review Local Terraform Project Data

Removing the Ubuntu package does not remove Terraform working directories, provider caches, saved plans, or state files from your projects. Review project data before deleting anything because state files can contain sensitive resource data.

find "$HOME" -name '.terraform' -type d -prune -print
find "$HOME" -name 'terraform.tfstate*' -type f -print
find "$HOME" -name '*.tfplan' -type f -print

Delete Terraform project directories or state files only after you have backed up anything you still need and confirmed that no team workflow, remote backend, or active infrastructure depends on that local state.

Conclusion

Terraform is installed on Ubuntu from HashiCorp’s signed APT repository, with a DEB822 source file, verified package candidate, local smoke test, update path, and cleanup plan in place. Before using it against real services, keep your configurations in Git and run terraform plan carefully so each change is visible before terraform apply.