Terraform taint and untaint (deprecated) - Step-by-Step Execution

Process Flow - Terraform taint and untaint (deprecated)

Start

↓

Identify resource

↓

Run 'terraform taint'

↓

Mark resource as tainted

↓

terraform apply

↓

Resource destroyed and recreated

↓

If needed, run 'terraform untaint'

↓

Remove taint mark

↓

terraform apply

↓

Resource left unchanged

↓

End

This flow shows how marking a resource as tainted forces its recreation on next apply, and untainting removes that mark to keep it unchanged.

Execution Sample

Terraform

terraform taint aws_instance.example
terraform apply
terraform taint aws_instance.example
terraform untaint aws_instance.example
terraform apply

Mark a resource as tainted to force recreation and apply (recreates); then taint again, untaint, apply to keep unchanged.

Process Table

Step	Command	Action	Resource State Before	Resource State After	Effect
1	terraform taint aws_instance.example	Mark resource as tainted	Healthy	Tainted	Resource flagged for recreation
2	terraform apply	Apply changes	Tainted	Healthy	Resource destroyed and recreated
3	terraform taint aws_instance.example	Mark resource as tainted	Healthy	Tainted	Resource flagged for recreation
4	terraform untaint aws_instance.example	Remove taint mark	Tainted	Healthy	Resource no longer flagged
5	terraform apply	Apply changes	Healthy	Healthy	Resource left unchanged

💡 No more commands; resource is healthy and unchanged.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Resource State	Healthy	Tainted	Healthy	Tainted	Healthy	Healthy

Key Moments - 3 Insights

Why does the resource get destroyed and recreated after 'terraform apply' when tainted?

Because marking a resource as tainted tells Terraform it is broken and must be replaced, so apply destroys and recreates it (see execution_table step 2).

What happens if you run 'terraform apply' without untainting after tainting?

Terraform destroys and recreates the resource once on the next apply. The new resource is not tainted, so subsequent applies leave it unchanged unless tainted again (execution_table step 2).

Does 'terraform untaint' change the actual resource immediately?

No, it only removes the taint mark in Terraform's state. The resource itself is unchanged until next apply (execution_table step 4).

Visual Quiz - 3 Questions

Look at the execution_table, what is the resource state immediately after running 'terraform taint aws_instance.example'?

A Healthy

B Tainted

C Recreated

D Destroyed

💡 Hint

Check the 'Resource State After' column in step 1 of the execution_table.

At which step does the resource get recreated?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Look for the step where 'Resource State After' changes to 'Healthy' from 'Tainted' indicating recreation in the execution_table.

If you skip 'terraform untaint' after tainting, what happens on the next 'terraform apply'?

A Resource is left unchanged

B Terraform throws an error

C Resource is recreated again

D Resource is deleted permanently

💡 Hint

Refer to key_moments about repeated recreation without untainting.

Concept Snapshot

terraform taint <resource>  # Mark resource as broken
terraform apply                 # Recreates tainted resource
terraform untaint <resource>    # Remove taint mark
terraform apply                 # Keeps resource unchanged

Note: This command is deprecated; use lifecycle blocks or resource replacement strategies instead.

Full Transcript

Terraform taint marks a resource as broken so Terraform will destroy and recreate it on the next apply. Running terraform apply after taint causes the resource to be replaced. Terraform untaint removes this mark so the resource is no longer flagged for replacement. Applying after untaint leaves the resource unchanged. This process helps fix resources without manual state edits. However, taint and untaint commands are deprecated in newer Terraform versions.