Terraform taint and untaint (deprecated) - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What happens when you run terraform taint on a resource?

You have a resource managed by Terraform. You run terraform taint on it. What is the immediate effect on Terraform's state and next apply?

A Terraform immediately deletes the resource from the cloud provider without waiting for <code>terraform apply</code>.

B Terraform removes the resource from its state file permanently, so it will no longer manage it.

C Terraform marks the resource as needing replacement, so the next <code>terraform apply</code> will destroy and recreate it.

D Terraform pauses the resource, preventing any changes until manually resumed.

💡 Hint

Think about what 'taint' means in real life: marking something as broken or needing replacement.

Running terraform taint marks a resource as 'tainted' in the state file. This tells Terraform that the resource is considered bad and should be replaced on the next terraform apply. It does not delete or remove the resource immediately.

❓ service_behavior

intermediate

What is the effect of terraform untaint on a tainted resource?

You have previously marked a resource as tainted. You now run terraform untaint on it. What happens to the resource in Terraform's state and next apply?

A Terraform removes the tainted mark, so the resource will not be replaced on the next apply.

B Terraform immediately recreates the resource in the cloud provider.

C Terraform deletes the resource from the state file and cloud provider.

D Terraform locks the resource to prevent any changes until unlocked.

💡 Hint

Untaint means to remove the 'broken' mark.

terraform untaint removes the tainted mark from a resource in the state file. This means Terraform will treat the resource as healthy and will not replace it on the next apply.

❓ Architecture

advanced

Why is terraform taint considered deprecated in Terraform 1.1+?

Terraform 1.1 and later versions mark terraform taint as deprecated. What is the main reason for this deprecation?

A Because tainting caused permanent deletion of resources which was unsafe.

B Because Terraform now supports <code>terraform apply -replace</code> which replaces resources without modifying state manually.

C Because Terraform no longer manages state files locally.

D Because tainting was replaced by a new command that pauses resources.

💡 Hint

Think about safer ways to replace resources without manual state changes.

Terraform introduced the -replace flag on terraform apply to replace resources safely without manually marking them tainted in the state. This makes terraform taint unnecessary and deprecated.

❓ security

advanced

What security risk can arise from using terraform taint improperly in a shared environment?

In a team using remote state, what security or operational risk can happen if someone taints a critical resource without coordination?

A Uncoordinated tainting can cause unexpected resource replacement, leading to downtime or data loss.

B Tainting encrypts the resource state making it inaccessible to others.

C Tainting disables resource access permissions permanently.

D Tainting automatically exposes resource secrets in logs.

💡 Hint

Think about what happens if a resource is replaced unexpectedly in production.

If a team member taints a resource without informing others, the next apply will replace it, possibly causing downtime or data loss. Coordination is important to avoid surprises.

✅ Best Practice

expert

Which Terraform command is recommended over terraform taint for replacing a resource in Terraform 1.1+?

You want to replace a resource safely without manually modifying the state. Which command should you use instead of terraform taint?

A <code>terraform refresh</code> to update the state and then <code>terraform apply</code>

B <code>terraform destroy -target=resource_address</code> followed by <code>terraform apply</code>

C <code>terraform state rm resource_address</code> then <code>terraform apply</code>

D <code>terraform apply -replace=resource_address</code>

💡 Hint

Look for a command that replaces a resource during apply without manual state edits.

Terraform 1.1+ recommends using terraform apply -replace=resource_address to replace resources safely. This avoids manual state changes and is less error-prone than tainting.