Terraform taint and untaint (deprecated) - Mini Project: Build & Apply

Terraform taint and untaint (deprecated)

📖 Scenario: You are managing a simple cloud infrastructure using Terraform. Sometimes, resources need to be marked for recreation due to issues or updates. Terraform used to have commands called taint and untaint to mark resources for recreation or to cancel that marking. These commands are now deprecated, but understanding them helps you manage resource lifecycle.

🎯 Goal: Learn how to mark a resource as tainted and then untaint it in Terraform configuration using the deprecated approach, simulating the effect by managing resource lifecycle manually.

📋 What You'll Learn

Create a Terraform resource block for an AWS S3 bucket named exactly example_bucket.

Add a variable should_taint to control whether the bucket should be recreated.

Use a lifecycle block with prevent_destroy set to false to allow recreation.

Add a conditional expression to simulate tainting by forcing recreation when should_taint is true.

💡 Why This Matters

🌍 Real World

Cloud engineers often need to recreate resources when they become unhealthy or need updates. Understanding taint and untaint helps manage resource lifecycle safely.

💼 Career

Knowing how to control resource recreation in Terraform is essential for infrastructure as code roles, ensuring stable and predictable deployments.

1

Create the AWS S3 bucket resource

Create a Terraform resource block named aws_s3_bucket.example_bucket with the bucket name set to "my-example-bucket-12345".

Terraform

# Your code here

Hint

Use the resource block with type aws_s3_bucket and name example_bucket. Set the bucket attribute to the exact string.

2

Add a variable to control tainting

Add a Terraform variable named should_taint of type bool with a default value of false.

Terraform

resource "aws_s3_bucket" "example_bucket" {
  bucket = "my-example-bucket-12345"
}

# Your code here

Hint

Define a variable block with the exact name should_taint, type bool, and default false.

3

Add lifecycle and conditional recreation logic

Inside the aws_s3_bucket.example_bucket resource block, add a lifecycle block with prevent_destroy = false. Then add a force_destroy attribute set to the value of var.should_taint to simulate tainting by forcing recreation when should_taint is true.

Terraform

resource "aws_s3_bucket" "example_bucket" {
  bucket = "my-example-bucket-12345"

  # Your code here
}

variable "should_taint" {
  type    = bool
  default = false
}

Hint

Add force_destroy = var.should_taint and a lifecycle block with prevent_destroy = false inside the resource block.

4

Simulate untaint by setting variable to false

Set the default value of the variable should_taint to false to simulate untainting the resource and preventing forced recreation.

Terraform

resource "aws_s3_bucket" "example_bucket" {
  bucket = "my-example-bucket-12345"

  force_destroy = var.should_taint

  lifecycle {
    prevent_destroy = false
  }
}

variable "should_taint" {
  type    = bool
  default = false
  # Your code here
}

Hint

Ensure the variable should_taint has default = false to simulate untainting.

Practice

1. What does the terraform taint command do to a resource?

easy

A. Marks the resource to be recreated on the next apply

B. Deletes the resource immediately

C. Prevents the resource from being changed

D. Updates the resource without recreation

Solution

1. Step 1: Understand the purpose of terraform taint

   This command marks a resource as needing recreation on the next terraform apply.

2. Step 2: Compare with other options

   It does not delete immediately, prevent changes, or update without recreation.

3. Final Answer:

   Marks the resource to be recreated on the next apply -> Option A

4. Quick Check:

   terraform taint = mark for recreation [OK]

Hint: Taint means mark resource for rebuild next apply [OK]

Common Mistakes:

• Thinking taint deletes resource immediately
• Confusing taint with preventing changes
• Assuming taint updates resource in place

2. Which of the following is the correct syntax to unmark a resource previously tainted in Terraform?

easy

A. terraform remove-taint <resource_name>

B. terraform clean <resource_name>

C. terraform untaint <resource_name>

D. terraform reset <resource_name>

Solution

1. Step 1: Recall the correct command for removing taint

   The command to remove the taint mark is terraform untaint followed by the resource name.

2. Step 2: Verify other options

   Other commands like remove-taint, clean, or reset do not exist in Terraform.

3. Final Answer:

   terraform untaint <resource_name> -> Option C

4. Quick Check:

   Untaint command syntax = terraform untaint [OK]

Hint: Untaint command is terraform untaint resource_name [OK]

Common Mistakes:

• Using non-existent commands like remove-taint
• Confusing untaint with terraform apply
• Omitting the resource name

3. Given the following commands executed in order:
terraform taint aws_instance.example
terraform apply
What will happen to the resource aws_instance.example?

medium

A. Terraform will throw an error

B. The resource will be destroyed and not recreated

C. The resource will remain unchanged

D. The resource will be recreated during apply

Solution

1. Step 1: Understand effect of taint before apply

   Taint marks the resource to be destroyed and recreated on next apply.

2. Step 2: Apply triggers recreation

   When terraform apply runs, it destroys the tainted resource and creates a new one.

3. Final Answer:

   The resource will be recreated during apply -> Option D

4. Quick Check:

   taint + apply = recreate resource [OK]

Hint: Taint then apply means resource rebuild [OK]

Common Mistakes:

• Thinking resource is only destroyed without recreation
• Assuming no change happens after taint
• Expecting an error from taint command

4. You ran terraform taint aws_instance.example by mistake. Which command fixes this so the resource is not recreated on next apply?

medium

A. terraform untaint aws_instance.example

B. terraform destroy aws_instance.example

C. terraform refresh aws_instance.example

D. terraform plan -refresh=false

Solution

1. Step 1: Identify how to remove taint

   The terraform untaint command removes the taint mark, preventing recreation.

2. Step 2: Check other commands

   destroy deletes resource, refresh updates state, and plan -refresh=false skips state refresh but does not remove taint.

3. Final Answer:

   terraform untaint aws_instance.example -> Option A

4. Quick Check:

   Untaint removes taint mark [OK]

Hint: Use untaint to cancel taint and keep resource [OK]

Common Mistakes:

• Using destroy instead of untaint
• Confusing refresh with untaint
• Trying to fix with plan options

5. Since terraform taint and terraform untaint are deprecated, which command replaces their functionality to recreate a resource?

hard

A. terraform destroy -replace=<resource_name>

B. terraform apply -replace=<resource_name>

C. terraform refresh -replace=<resource_name>

D. terraform plan -replace=<resource_name>

Solution

1. Step 1: Understand deprecation and replacement

   Terraform deprecated taint/untaint and recommends terraform apply -replace to recreate resources.

2. Step 2: Verify other options

   refresh, destroy, and plan do not support -replace to recreate resources.

3. Final Answer:

   terraform apply -replace=<resource_name> -> Option B

4. Quick Check:

   Replace flag with apply recreates resource [OK]

Hint: Use apply -replace to recreate resource now [OK]

Common Mistakes:

• Trying to use -replace with refresh or destroy
• Not knowing taint/untaint are deprecated
• Confusing plan with apply for replacement