terraform import vs terraform taint: Key Differences
Fast recall
Quick revision
Core answer
Whether you understand two important Terraform state manipulation commands and the operational scenarios that call for each.
Thinking `terraform taint` deletes a resource immediately — it only marks it for replacement on the next `apply`. Also, `terraform import` does not generate HCL — the config must already exist.
Mention that `terraform taint` was deprecated in Terraform 1.5+ in favor of `terraform apply -replace`, and that `terraform import` only imports a single resource at a time (though `import` blocks in v1.5+ allow bulk import in config).
Interview-ready guide
Interview answer
Terraform import and terraform taint solve opposite problems. Import brings an existing cloud resource under Terraform management without recreating it. Taint (or its modern replacement, -replace) forces Terraform to destroy and recreate a resource on the next apply even if no configuration changed.
`terraform import` — bringing existing resources into state
- When infrastructure was created outside Terraform (console, CLI, CloudFormation), import adds it to Terraform state without touching the real resource —
terraform import aws_instance.web i-0abc123def456789maps the real EC2 instance to theaws_instance.webresource address in your configuration - Import only writes to state — it does not generate the HCL configuration for you; you must write the matching resource block in your
.tffiles first, then import; the generated state must match the actual resource attributes or the next plan will show unnecessary changes - After import, run
terraform planimmediately and verify the plan showsNo changes— a plan that shows modifications after import means the configuration does not match the real resource and needs adjustment before applying
`terraform apply -replace` — forced recreation
-replace=aws_instance.webdestroys and recreates the specified resource on the next apply, even if no configuration attribute changed — the modern replacement forterraform taint(deprecated in 0.15.2)- Use it when the resource is in a broken state that configuration changes cannot fix: an EC2 instance with a corrupted filesystem, an RDS instance in a failed state that requires recreation, an SSL certificate that was revoked and needs replacement
- The replace flag only affects the current apply; it does not persist in state — unlike the old
taintwhich marked state permanently until applied;-replaceis safer because the intent is explicit at apply time
When to use each
- Use
importfor brownfield adoption: taking over existing infrastructure managed manually or by another tool - Use
-replacefor repair: forcing recreation of a resource that is broken in a way Terraform cannot detect from configuration differences
terraform import vs terraform taint: Key Differences
Direct Answer
terraform import brings an existing resource under Terraform management without destroying it; terraform taint (deprecated, now -replace flag) marks a resource for forced replacement on the next apply.
Common Mistakes & Pitfalls
Thinking terraform taint deletes a resource immediately — it only marks it for replacement on the next apply. Also, terraform import does not generate HCL — the config must already exist.
Check your understanding
Answer these without looking back at the article.
- How do you import multiple resources at once in Terraform 1.5+?
- What is the workflow after terraform import to ensure state matches config?
- When would you use terraform state rm instead of terraform taint?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.