tainted resource not enforced on plan or apply for resources using count. v0.7

[elliottucker]

Terraform Version

Terraform v0.7.0
OSX 10.11.6
installed via homebrew

Affected Resource(s)

• aws_instance

Terraform Configuration Files

variable "host_count" {
  default = {
    "web" = 2
    }
}

resource "aws_instance" "web" {
  count = "${var.host_count["web"]}"
  ami = "${lookup(var.images,var.region)}"
  instance_type = "c3.large"
  subnet_id = "${element(aws_subnet.internal.*.id, count.index)}"
  vpc_security_group_ids = ["${var.sg_default_id}","${aws_security_group.web.id}"]
  iam_instance_profile = "iam-web"
  key_name = "secret"
  ebs_block_device {device_name = "/dev/xvdf" volume_size = 50 volume_type = "standard"}
  lifecycle {
    ignore_changes = ["ami", "user-data"]
  }
  tags {
    Name = "web-${count.index}"
    Role = "Web"
    Stack = "${var.stackname}"
  }

  user_data = <<EOF
#!/bin/bash
## stuff
EOF

Expected Behavior

I am running the command:
terraform taint aws_instance.web.0
This returns:

The resource aws_instance.web.0 in the module root has been marked as tainted!

When I run plan and apply, i'd expect the instance to be destroyed and recreated.

Actual Behavior

When I run plan and apply:

No changes. Infrastructure is up-to-date. This means that Terraform
could not detect any differences between your configuration and
the real physical resources that exist. As a result, Terraform
doesn't need to do anything.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform taint aws_instance.web.0
2. terraform plan
3. terraform apply

Important Factoids

Using s3 remote state
terraform remote config -backend s3 -backend-config="bucket=mybucket" -backend-config="key=terraform/stackname" -backend-config="region=us-east-1"

Running terraform show shows the resource as tainted

aws_instance.web.0: (tainted)

[mengesb]

I think I'm seeing this as well; but count doesn't seem to matter either. I have a file generated by template that I dump to the filesystem, when I taint that resource it doesn't re-write the file.

I then converted to the new data source, and it shows my template items twice when using terraform state show data.template_file.knife-rb resource

I'm using the local state

[cbarbour]

I ran into this issue as well. The workaround was to use terraform destroy --target=aws_instance.web; terraform apply

As an asside, it would be nice to be able to taint aws_instance.web rather than aws_instance.web.0, aws_instance.web.1, etc.

[radeksimko]

Hi,
the correct syntax in 0.7+ is terraform taint aws_instance.web[0] (i.e. square brackets instead of a dot).

That said I agree that Terraform should be returning some kind of error instead of

The resource aws_instance.web.0 in the module root has been marked as tainted!

@elliottucker-swrve Would you mind re-trying the taint operation with the new address format and confirm that it works for you so we can confirm this is only caused by the syntax?

[elliottucker]

OK I tried that syntax using zsh (not bash) and I get

$ terraform taint aws_instance.web[0]
zsh: no matches found: aws_instance.web[0]

and wrapped in quotes...

$ terraform taint "aws_instance.web[0]"                                          [11:29:28]
The resource aws_instance.web[0] couldn't be found in the module root.

and in Bash:

bash-3.2$ terraform taint aws_instance.web[0]
The resource aws_instance.web[0] couldn't be found in the module root.

So a bit better in bash in that I don't need quotes but not better in that it's not finding it. To verify this, using dot notation...

bash-3.2$ terraform taint aws_instance.web.0
The resource aws_instance.web.0 in the module root has been marked as tainted!

And running plan, same problem. No changes identified.

[phinze]

Thanks for the reports! This is fixed in #8167 which will come out with v0.7.1 due out next week. 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.