What is the difference between terraform taint and terraform replace?
Compare terraform taint and terraform apply -replace: how each forces resource recreation, why taint is deprecated, and which approach is safer and recommended.
Expected Interview Answer
Both force a resource to be destroyed and recreated, but terraform taint mutates the state file immediately to mark a resource for replacement on the next apply, while terraform apply -replace=ADDRESS requests replacement at plan time without pre-modifying state, making it the modern, safer, recommended approach — taint is deprecated.
terraform taint was a stateful side-effect: it flagged the resource in state so any subsequent plan showed it being recreated, which was easy to forget or apply accidentally. The -replace flag, introduced in Terraform 0.15.2, moves the intent into a single plan/apply command, so the replacement is visible in the plan you review and never leaves lingering state changes if you don't apply. Functionally the recreation is identical; the difference is that -replace is explicit, reviewable, and does not corrupt state if you abort.
- -replace shows the recreation in the plan before you apply
- -replace leaves state untouched if you cancel the apply
- Avoids the forgotten-taint problem where state stays marked
- Single command instead of taint-then-apply two-step
- Recommended and future-proof since taint is deprecated
AI Mentor Explanation
terraform taint is like putting a permanent red mark next to a player's name in the team ledger saying 'must be replaced' — it stays there until someone acts, and a new selector might apply it without realizing. terraform replace is like raising the substitution during the match review itself: everyone sees the swap proposed, discusses it, and it only happens when the decision is confirmed, leaving no stray mark in the ledger if the captain changes their mind before the next game.
Step-by-Step Explanation
Step 1
Identify the resource to recreate
Pick the resource address, e.g. aws_instance.web, that is in a bad or drifted state and must be rebuilt.
Step 2
Prefer the -replace flag
Run terraform plan -replace=aws_instance.web to preview the destroy-and-recreate before applying.
Step 3
Review the plan
Confirm the plan shows the resource being replaced and check for downstream dependencies that also change.
Step 4
Apply the replacement
Run terraform apply -replace=aws_instance.web to execute the recreation in one reviewed step.
Step 5
Avoid deprecated taint
Only use terraform taint on very old Terraform versions; on 0.15.2+ prefer -replace for safety and clarity.
What Interviewer Expects
- Knows both force a destroy-and-recreate of the resource
- Explains that taint mutates state immediately while -replace acts at plan time
- States that taint is deprecated in favor of -replace
- Can give the exact -replace command syntax
- Understands why reviewing the plan first is safer
Common Mistakes
- Believing taint and replace do fundamentally different things to the resource
- Forgetting a tainted resource stays marked in state until applied or untainted
- Not knowing terraform taint is deprecated
- Using taint on modern Terraform instead of -replace
- Applying a tainted resource accidentally because the mark persisted
Best Answer (HR Friendly)
“Both terraform taint and terraform replace tell Terraform to rebuild a specific resource from scratch. The difference is that taint marks it immediately in the saved state, while replace shows the rebuild in a plan you review first — which is safer, so replace is now the recommended way and taint is deprecated.”
Code Example
# Deprecated two-step (older Terraform):
terraform taint aws_instance.web
terraform apply
# Undo a taint before applying:
terraform untaint aws_instance.web
# Recommended (Terraform 0.15.2+): single, reviewable command
terraform plan -replace="aws_instance.web"
terraform apply -replace="aws_instance.web"Follow-up Questions
- Why was terraform taint deprecated?
- What does terraform untaint do?
- How does -replace behave if you cancel the apply?
- Can you replace multiple resources in a single apply?
- How does replacement interact with dependent resources?
MCQ Practice
1. How does terraform taint differ from terraform apply -replace?
taint marks the resource in state right away; -replace expresses the same intent at plan time without pre-modifying state and is the recommended approach.
2. Which command is recommended on modern Terraform to force recreation of a resource?
Since 0.15.2, terraform apply -replace=ADDRESS is the recommended, reviewable way; taint is deprecated.
3. What is the risk of terraform taint compared to -replace?
Because taint immediately changes state, a forgotten mark can be applied on a later run without a fresh review.
Flash Cards
What do taint and -replace have in common? — Both force Terraform to destroy and recreate a specific resource on apply.
What is the key difference? — taint mutates state immediately; -replace requests replacement at plan time without pre-modifying state.
Which is recommended? — terraform apply -replace=ADDRESS — taint has been deprecated since Terraform 0.15.2.
How do you undo a taint? — Run terraform untaint ADDRESS before applying to clear the replacement mark from state.