One instance in a for_each set, aws_instance.worker["b"], has a corrupted boot disk. Its configuration is fine, so a normal plan shows no changes. The team wants to rebuild just that instance through a reviewable plan. Which approach is current practice?
Select an answer to reveal the explanation.
![To Create an exciting colorful infographic that explains the concepts in the question: Question: One instance in a foreach set, awsinstance.worker["b"], has a corrupted boot disk. Its configuration is fine, so a normal plan shows no changes. The team wants to rebuild just that instance through a reviewable plan. Which approach is current practice? Correct Answer: Run terraform plan -replace='awsinstance.worker["b"]', review the replacement, and apply it. Put EVERY visible label in double quotes. No people. No A/B/C/D letters. In one of the four corners put a little "Navy Duck".](/media/hashicorp/terraform-pro-002/TERRAFORM-PRO-002-e1-q057.webp)
Short Explanation
When one box in the rack is sick, you swap just that box. The -replace option tells Terraform 'rebuild this one even though the code didn't change', and you see it in the plan first. The trap is taint, which still exists but is deprecated in favor of -replace.
Full Explanation
The -replace=ADDRESS planning option instructs Terraform to plan a replacement for the given resource instance even when the configuration would normally produce an update or no action. It is intended for exactly this case: a remote object has become degraded, and an immutable rebuild with the same configuration is the fix. Because it is a planning option, the replacement shows up in the plan for review, and it can be repeated to replace several instances at once. The terraform taint command achieved a similar result in older versions, but it is deprecated, and it changes state immediately rather than showing its effect in a plan first. The -target option limits planning to the named address and its dependencies, but it does not force replacement; with unchanged configuration the targeted plan would still show no changes. Refresh-only mode only updates state to match remote attributes and never plans infrastructure changes, and a corrupted disk generally does not appear as an attribute difference anyway. Exam caveat: -replace cannot be combined with -destroy, and for_each addresses need shell quoting around the key. Operational check: run the plan with -replace, confirm exactly one instance shows as must be replaced, then apply that plan.