A configuration declares resource "aws_iam_user" "this" with for_each = toset(["alice", "bob", "carol"]). An operator must force replacement of only alice's user. Which address should be passed to terraform apply -replace?
Select an answer to reveal the explanation.
![To Create an exciting colorful infographic that explains the concepts in the question: Question: A configuration declares resource "awsiamuser" "this" with foreach = toset(["alice", "bob", "carol"]). An operator must force replacement of only alice's user. Which address should be passed to terraform apply -replace? Correct Answer: awsiamuser.this["alice"] Put EVERY visible label in double quotes. No people. No A/B/C/D letters. In one of the four corners put a little "Navy Duck".](/media/hashicorp/terraform-pro-002/TERRAFORM-PRO-002-e1-q016.webp)
Short Explanation
With for_each, every instance wears a name tag, and its address uses that tag in square brackets. alice is the key, so you write this["alice"]. The trap is the [0] index, which only exists when you use count.
Full Explanation
Resource instances created with for_each are identified by their key, written in square brackets after the resource address, so the alice instance is aws_iam_user.this["alice"]. For a set of strings, each element is both the key and the value, which makes the user name the instance key. Passing that address to terraform apply -replace tells Terraform to plan a replacement for that one instance while leaving bob and carol untouched; -replace is the supported replacement for the deprecated terraform taint command. A numeric index such as [0] addresses count-based instances; for_each instances have no positional index, so that address matches nothing. Dot notation such as this.alice is attribute access syntax, not instance-key syntax, and does not identify an instance. Swapping the resource name and the key produces a resource named alice that does not exist. Exam caveat: on most shells the address needs quoting so the brackets and inner quotes survive, for example by wrapping the whole -replace argument in single quotes. Operational check: run terraform state list to see the exact instance addresses, then run terraform plan with -replace and confirm exactly one instance is marked for replacement.