A single resource
The commands come out quoted, and the untargeted plan afterwards is part of the output
aws_instance.web
Terraform target Flag Builder
Build correctly quoted -target and -replace flags. Both narrow what Terraform does, and only one of them is meant for routine use.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Build. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A whole module
Targets everything the module declares, which is rarely what narrowing meant
module.vpc
Six addresses
A sign the root module holds things with unrelated lifecycles
aws_instance.a aws_instance.b aws_instance.c aws_instance.d aws_instance.e aws_instance.f
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Using -target as part of a normal workflow
Every targeted apply leaves the unnamed resources unreconciled, so drift accumulates invisibly and surfaces later as a large, surprising plan.
Instead:Use it to break a deadlock or recover from a failed apply, then run an untargeted plan and read it.
Using -target plus taint to recreate a resource
That marks state and hides the rest of the plan. -replace does the same job with a full plan you can review first.
Instead:Use terraform apply -replace='ADDRESS'.
Targeting a module to narrow a plan
A module address includes every resource inside it and their dependencies, which for most modules is not narrow at all.
Instead:Target the specific resource: module.vpc.aws_subnet.private.
A targeted plan has never been checked against the whole configuration
Terraform prints a warning saying so. The reason it matters is not the run in front of you but the ones after it.
Targeting excludes everything except the target and its dependencies
So the apply succeeds and the resources you did not name keep diverging from the configuration, with nothing looking at them. Used once to break a deadlock that is fine. Used every day, it hides drift indefinitely, and the drift is discovered by the first person who runs an untargeted plan.
-replace is the right flag for recreating one thing
-replace=ADDRESS plans a destroy and a create for that resource and leaves the rest of the plan intact, so you still see everything else. It replaced terraform taint, which marked state directly and gave you nothing to review first. If the goal is to recreate rather than to narrow, this is the flag.
Targeting a module pulls in everything inside it
A module address means every resource the module declares, plus their dependencies. For a module of any size that is most of the configuration, which defeats the point. Name the resource inside the module instead.
Needing many targets is a structural signal
If a manageable plan requires naming six resources, the state holds things with unrelated lifecycles, and every person has to repeat the same flags. That is a root module that wants splitting, and the targeting is treating the symptom.
Quote the address
Brackets are glob characters, so zsh fails before Terraform runs and bash strips the quotes around a for_each key. Single quotes around the whole address are the fix, and the commands here already have them.
Always run an untargeted plan afterwards
It is the only thing that tells you what the targeted run left behind. Reading it is the step that turns targeting from a habit into a tool.
More terraform tools
Terraform Validator & Formatter Does it parse, and is it formatted? Terraform dynamic Block Generator It is ingress.value, not each.value Terraform check and precondition Generator A failed check does not stop the apply Terraform variables.tf Generator From the var. references you already wrote Terraform Unused Declaration Linter Dead variables, locals and data sources Terraform Atlantis YAML Generator when_modified misses your modules Terraform Function Tester and HCL Console terraform console, in a tab Terraform for Expression Tester Where do the keys collide? Terraform Interpolation Tester null becomes an empty string Terraform templatefile Tester Render it before you apply it Terraform Resource Count Calculator How many objects, not how many blocks Terraform count to for_each Converter With the moved blocks it needs Terraform moved Block Generator Rename without destroying Terraform state mv Command Builder No plan, no undo Terraform outputs.tf Generator Outputs are not sensitive by default Terraform Remote State Data Source Generator It grants read of the whole state Terraform Provider Block Generator docker is not hashicorp/docker Terraform .gitignore Generator and Checker .terraform* eats the lock file Terraform to OpenTofu Migration Checker The state is the part to watch Terraform tfvars to JSON Converter The JSON file wins Terraform Version Constraint Parser What ~> actually allows Terraform Resource Address Parser Quote it before the shell eats it Terraform cidrsubnet Calculator newbits is added, not the target Terraform Import Block Generator The id is not the name Terraform Lock File Viewer Why CI fails and your laptop does not Terraform Variables Checker A missing value hangs CI Terraform tfvars to Env Vars Converter Lists and maps have to be JSON Terraform Deprecated Syntax Checker What a current Terraform rejects Terraform State File Viewer Read it without uploading it Terraform Plan JSON Viewer It is not redacted Terraform HCL to JSON Converter And what the conversion loses Terraform Module Source Validator version only works for the registry Terraform Backend Config Decoder Is state actually locked? Terraform Naming Convention Validator A hyphen makes a resource unreferenceable