Terraform Taint / Untaint Command Builder

The Terraform Taint / Untaint Command Builder assembles a correct terraform taint or terraform untaint command from a small form, so you never mistype the mode, the resource address, or the flag order. Tainting marks a managed resource for destruction and recreation on the next apply, which is useful when a resource has drifted, been corrupted, or its configuration must be rebuilt from scratch. Untainting removes that mark so a resource is treated as stable again. Both are sharp tools: tainting the wrong address can trigger an unexpected rebuild and downtime, so getting the exact command right matters far more than it first appears. This builder validates the address, keeps the flags in the correct position, and lets you choose a plain command or a CI friendly wrapper before you ever touch a terminal.

Everything runs locally in your browser. Nothing is uploaded, no Terraform binary is executed, and no cloud connection is made at any point. The builder is a safe way to prepare a command you will paste into a terminal, a runbook, or a pipeline script after you have confirmed the target is correct. It is a preparation aid, not an execution engine: it shows you the command, then you decide when and where to run it. That separation keeps a powerful operation deliberate and reviewable.

Tainting is best reserved for cases where in place updates are impossible, such as a change to a force replace argument or a permanently broken instance. Because the effect is a destroy followed by a create, it should be rehearsed in a plan and communicated to teammates who may be working on the same state. The CI style option exists precisely for those moments: it wraps the command so a pipeline fails loudly rather than proceeding with a half applied change.

• taint or untaint - pick the mode from a dropdown.
• Resource address - validated to be present and to contain no spaces, because a spaced address would break the command.
• Optional flags - -allow-missing and -lock=false are added in the correct order after the mode and before the address.
• CI command style - switch to a CI friendly wrapper that fails fast with set -euo pipefail.
• Address quoting - addresses containing spaces are automatically quoted so the shell parses them correctly.
• Copy / Download / Print - get the command wherever you need it.

1. Pick taint or untaint from the mode dropdown depending on whether you want to force a rebuild or clear a taint mark.
2. Enter the resource address, for example aws_instance.foo or module.app.aws_instance.db, exactly as it appears in state.
3. Tick the optional flags you need: -allow-missing to ignore a missing resource, and -lock=false to skip state locking when your backend is unavailable.
4. Choose a command style: Plain for an interactive terminal, or CI to wrap it for a script.
5. Build the command and copy, download, or print it for your runbook or pipeline.
6. Run it deliberately only after you have confirmed the address points at the intended resource.

Example 1: mode taint, address aws_instance.foo, with -allow-missing, produces terraform taint -allow-missing aws_instance.foo. Example 2: mode untaint, address aws_instance.foo, with -lock=false, produces terraform untaint -lock=false aws_instance.foo. Example 3: the same taint command in CI style becomes a small script that sets strict shell options before running terraform, so a failure stops the job instead of continuing. Example 4: an address with a space is quoted automatically, so module app.aws instance.foo is wrapped in single quotes rather than split by the shell. Example 5: leaving every flag unticked yields the minimal terraform taint aws_instance.foo, which is the safest command to rehearse in a plan before adding options.

• Correct syntax - mode, address and flags are assembled in the right order every time.
• Validated - a missing or spaced address is caught before you run anything.
• Safer operations - the exact command is shown for review, reducing the chance of tainting the wrong resource.
• CI ready - the CI style wrapper makes the command safe to drop into a pipeline without extra editing.
• Private - everything runs in the browser, no upload, no network, no credentials.
• Portable - copy, download or print the command for handoff and audit trails.