Why Terraform taint and untaint (deprecated)? - Purpose & Use Cases

The Big Idea

What if you could tell your infrastructure exactly what to fix without lifting a finger?

The Scenario

Imagine you manage a big garden with many plants. One plant gets sick, so you want to remove it and plant a new one. Doing this by hand means digging up the sick plant carefully and planting a new seed, which takes time and effort.

The Problem

Manually digging up and replacing plants is slow and can damage nearby plants. You might forget which plant was sick or accidentally remove a healthy one. This causes confusion and extra work.

The Solution

Terraform's taint and untaint commands let you mark a resource as needing replacement or keep it safe without manual digging. This way, Terraform knows exactly what to replace or keep, making updates smooth and error-free.

Before vs After

✗ Before

terraform apply
# Manually delete resource outside Terraform
terraform apply

✓ After

terraform taint <resource>
terraform apply
terraform untaint <resource>

What It Enables

This lets you quickly and safely replace or preserve parts of your infrastructure without guesswork or manual errors.

Real Life Example

When a server has a hidden problem, you can mark it as 'tainted' so Terraform replaces it on the next update, avoiding downtime or manual tracking.

Key Takeaways

Manual fixes are slow and risky.

Taint/untaint mark resources for replacement or preservation.

This makes infrastructure updates safer and easier.

Practice

1. What does the terraform taint command do to a resource?

easy

A. Marks the resource to be recreated on the next apply

B. Deletes the resource immediately

C. Prevents the resource from being changed

D. Updates the resource without recreation

Solution

1. Step 1: Understand the purpose of terraform taint

   This command marks a resource as needing recreation on the next terraform apply.

2. Step 2: Compare with other options

   It does not delete immediately, prevent changes, or update without recreation.

3. Final Answer:

   Marks the resource to be recreated on the next apply -> Option A

4. Quick Check:

   terraform taint = mark for recreation [OK]

Hint: Taint means mark resource for rebuild next apply [OK]

Common Mistakes:

• Thinking taint deletes resource immediately
• Confusing taint with preventing changes
• Assuming taint updates resource in place

2. Which of the following is the correct syntax to unmark a resource previously tainted in Terraform?

easy

A. terraform remove-taint <resource_name>

B. terraform clean <resource_name>

C. terraform untaint <resource_name>

D. terraform reset <resource_name>

Solution

1. Step 1: Recall the correct command for removing taint

   The command to remove the taint mark is terraform untaint followed by the resource name.

2. Step 2: Verify other options

   Other commands like remove-taint, clean, or reset do not exist in Terraform.

3. Final Answer:

   terraform untaint <resource_name> -> Option C

4. Quick Check:

   Untaint command syntax = terraform untaint [OK]

Hint: Untaint command is terraform untaint resource_name [OK]

Common Mistakes:

• Using non-existent commands like remove-taint
• Confusing untaint with terraform apply
• Omitting the resource name

3. Given the following commands executed in order:
terraform taint aws_instance.example
terraform apply
What will happen to the resource aws_instance.example?

medium

A. Terraform will throw an error

B. The resource will be destroyed and not recreated

C. The resource will remain unchanged

D. The resource will be recreated during apply

Solution

1. Step 1: Understand effect of taint before apply

   Taint marks the resource to be destroyed and recreated on next apply.

2. Step 2: Apply triggers recreation

   When terraform apply runs, it destroys the tainted resource and creates a new one.

3. Final Answer:

   The resource will be recreated during apply -> Option D

4. Quick Check:

   taint + apply = recreate resource [OK]

Hint: Taint then apply means resource rebuild [OK]

Common Mistakes:

• Thinking resource is only destroyed without recreation
• Assuming no change happens after taint
• Expecting an error from taint command

4. You ran terraform taint aws_instance.example by mistake. Which command fixes this so the resource is not recreated on next apply?

medium

A. terraform untaint aws_instance.example

B. terraform destroy aws_instance.example

C. terraform refresh aws_instance.example

D. terraform plan -refresh=false

Solution

1. Step 1: Identify how to remove taint

   The terraform untaint command removes the taint mark, preventing recreation.

2. Step 2: Check other commands

   destroy deletes resource, refresh updates state, and plan -refresh=false skips state refresh but does not remove taint.

3. Final Answer:

   terraform untaint aws_instance.example -> Option A

4. Quick Check:

   Untaint removes taint mark [OK]

Hint: Use untaint to cancel taint and keep resource [OK]

Common Mistakes:

• Using destroy instead of untaint
• Confusing refresh with untaint
• Trying to fix with plan options

5. Since terraform taint and terraform untaint are deprecated, which command replaces their functionality to recreate a resource?

hard

A. terraform destroy -replace=<resource_name>

B. terraform apply -replace=<resource_name>

C. terraform refresh -replace=<resource_name>

D. terraform plan -replace=<resource_name>

Solution

1. Step 1: Understand deprecation and replacement

   Terraform deprecated taint/untaint and recommends terraform apply -replace to recreate resources.

2. Step 2: Verify other options

   refresh, destroy, and plan do not support -replace to recreate resources.

3. Final Answer:

   terraform apply -replace=<resource_name> -> Option B

4. Quick Check:

   Replace flag with apply recreates resource [OK]

Hint: Use apply -replace to recreate resource now [OK]

Common Mistakes:

• Trying to use -replace with refresh or destroy
• Not knowing taint/untaint are deprecated
• Confusing plan with apply for replacement