highIntermediateSymptom-first#plan#drift#destroy#replace

Plan shows unexpected destroy — resource drift or replacement

terraform plan shows - destroy for resources that should exist

Likely source:configurationdata-loss

Focused incident mode — strips away everything but this runbook.

Symptoms

  • terraform plan shows - destroy for resources that should exist
  • Resources appear to be replaced instead of updated in-place
  • Drift detected after manual console changes

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Plan output showing destroys

    terraform plan 2>&1 | grep -E '(-\s|~\s|\+\s)' | head -30

  • State file resource count

    terraform state list | wc -l

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • plan shows update-in-place or replacement for the resource
  • A teammate or automation modified the resource outside Terraform

Confirm before fixing

terraform plan -refresh-only 2>&1 | grep -E '(-|~)' | head -10
READ

Show only drift changes

Expected: Diff showing the manual change

Fix

terraform apply -target=<RESOURCE-ADDR>
CHANGE

Re-apply the Terraform config to bring the resource back into sync

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
terraform plan 2>&1 | tail -20
READ

See the full plan output before acting

2
terraform refresh -target=<RESOURCE-ADDR>
READ

Sync state with reality for the drifted resource

3
terraform apply -target=<RESOURCE-ADDR>
CHANGE

Re-apply to bring the resource back to the desired config

Prevention

  • Enable terraform plan in CI and require approval on non-destroy diffs.
  • Use prevent_destroy lifecycle on critical resources.
  • Run terraform plan -refresh-only weekly in CI to detect drift early.
  • Avoid manual console changes — use Terraform for all mutations.

Related runbooks

Same stack, same failure family — worth a skim.

State file gone — everything shows as newcritical

terraform plan shows everything will be created (no existing resources in state)

TerraformProduction2 causes
Open runbook
Moved block missing — planned destroy for resource that still existshigh

terraform plan shows - destroy for a resource that is still live

TerraformAdvanced2 causes
Open runbook
Unintended terraform destroy — infrastructure wipedcritical

terraform destroy shows all resources will be destroyed

TerraformProduction2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.