terraform taint command

Theterraform taint command marks specified objects in the Terraform state as tainted. Use theterraform taint command when objects become degraded or damaged. Terraform prompts you to replace the tainted objects in the next plan you create.

This command is deprecated. Instead, add the-replace option to yourterraform apply command.

Recommended Alternative

For Terraform v0.15.2 and later, we recommend using the-replace option withterraform apply to force Terraform to replace an object even though there are no configuration changes that would require it.

$ terraform apply -replace="aws_instance.example[0]"

We recommend the-replace option because the change will be reflected in the Terraform plan, letting you understand how it will affect your infrastructure before you take any externally-visible action. When you useterraform taint, other users could create a new plan against your tainted object before you can review the effects.

Usage

$ terraform taint [options] <address>

Theaddress argument is the address of the resource to mark as tainted.The address is inthe resource address syntax,as shown in the output from other commands, such as:

• aws_instance.foo
• aws_instance.bar[1]
• aws_instance.baz[\"key\"] (quotes in resource addresses must be escaped on the command line, so that they will not be interpreted by your shell)
• module.foo.module.bar.aws_instance.qux

This command accepts the following options:

• -allow-missing - If specified, the command will succeed (exit code 0)even if the resource is missing. The command might still return an errorfor other situations, such as if there is a problem reading or writingthe state.

• -lock=false - Disables Terraform's default behavior of attempting to takea read/write lock on the state for the duration of the operation.

• -lock-timeout=DURATION - Unless locking is disabled with-lock=false,instructs Terraform to retry acquiring a lock for a period of time beforereturning an error. The duration syntax is a number followed by a timeunit letter, such as "3s" for three seconds.

For configurations using theHCP Terraform CLI integration or theremote backend only,terraform taintalso accepts the option-ignore-remote-version.

For configurations usingthelocal backend only,terraform taint also accepts the legacy options-state,-state-out, and-backup.