Terraform destroy target operations allow selective deletion of infrastructure resources from the state file and cloud provider APIs. The destroy command terminates a complete set of cloud infrastructure or a targeted resource by deleting infrastructure resources present in the state file. When the destroy command is executed, Terraform first validates the information contained in the state file by cross-checking with cloud provider APIs. Internally it builds a dependency graph to identify the sequence in which the resources are to be destroyed.
Before running terraform destroy you should review the changes and verify the execution plan using terraform plan -destroy. Once executed, terraform destroy permanently deletes the targeted resources. The state file is Terraform’s source of truth when performing any operation. If the state file is corrupted, Terraform can behave in unwarranted ways. If the state file does not mention a certain resource—but the resource exists in the real world—then running terraform destroy will NOT destroy that resource.
Note: terraform destroy only affects resources in the current state file and backend. If you have multiple workspaces or backends, you must destroy each independently.
Terraform Destroy Target Flag Mechanics
The -target flag lets you apply or destroy specific resources instead of processing the entire Terraform state. This is useful in several scenarios:
- Faster Iteration: When testing a specific resource change.
- Selective Deployment: Updating a single service without modifying the rest.
- Debugging: Identifying and fixing misconfigurations in isolation.
- Partial Destruction: Removing a problematic resource without affecting dependencies.
While useful, improper use -target can lead to an inconsistent Terraform state if not handled carefully.
The -target flag limits the plan to only the specified resources and their dependencies. For example, to reference a VM only:
terraform plan -target=azurerm_linux_virtual_machine.example
Read more about targeting resources with terraform plan.
To target and destroy a specific resource in Terraform, use the -target flag with the terraform destroy command. This destroys only the specified resource without affecting the rest of the infrastructure.
Use this feature carefully, as destroying a single resource may break dependencies or state consistency if other resources depend on it. Always run terraform plan first to verify the impact.
For example, similar to the apply and plan command, to destroy your Azure Virtual Machine only and ignore all other resources, you can run terraform destroy command with the -target flag to reference the VM only:
terraform destroy -target=azurerm_linux_virtual_machine.example
When should you avoid using the target flag in Terraform?
In short: use -target only for exceptional debugging or emergency fixes. If it’s part of your normal deployment process, your project layout probably needs refactoring.
The -target option is not for routine use, and is provided only for exceptional situations such as recovering from errors or mistakes, or when Terraform specifically suggests to use it as part of an error message.
Syntax And Command Forms
terraform apply -target syntax:
terraform apply -target=<resource_type.resource_name>
terraform destroy command with -target can be used to destroy only what you no longer need, or that is not working properly.
You can also refer to the entire collection of resources at once.
$ terraform destroy -target="aws_s3_object.objects"
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
- destroy
Terraform will perform the following actions:
awss3object.objects[0] will be destroyed
Plan: 0 to add, 0 to change, 4 to destroy.
Warning: Resource targeting is in effect
You are creating a plan with the -target option, which means that the result of this plan may not represent all of the changes requested by the current configuration.
The -target option is not for routine use, and is provided only for exceptional situations such as recovering from errors or mistakes, or when Terraform specifically suggests to use it as part of an error message.
Do you really want to destroy all resources?
Terraform will destroy all your managed infrastructure, as shown above.
There is no undo. Only 'yes' will be accepted to confirm.
Enter a value: yes
awss3bucketobject.objects[3]: Destroying... [id=learningrationallylatelyslowlycarefulwarthog.txt]
awss3bucketobject.objects[1]: Destroying... [id=learningpartiallyeminentlyintenselyelegantworm.txt]
awss3bucketobject.objects[2]: Destroying... [id=mostlymanuallycertainlycheerful_quetzal.txt]
awss3bucket_object.objects[0]: Destroying..
Terraform Destroy Command Options
You can use terraform destroy command with different options, for example:
- terraform destroy -auto-approve
By default, whenever you run a terraform destroy, you will first see a destroy plan and have to approve it manually. Taking advantage of the “-auto-approve” option lets you destroy all resources without the need of any manual approval. This can be useful in CI/CD pipelines, especially for ephemeral environments that you want to destroy on a schedule, or whenever an event occurs.
- terraform destroy -refresh=false
By using the -refresh=false option with terraform destroy, you ensure that resources are destroyed based on the information Terraform has in the state file, without refreshing the state prior to running this operation.
Use -refresh=false only when you fully trust your state; otherwise, you risk trying to destroy resources that no longer exist or missing ones that were changed manually.
The terraform destroy command should be used mostly when you want to tear down your infrastructure resources. However, there are cases where you will use the target option to destroy only what you no longer need, or that is not working properly.
Reversibility And State Management
Is terraform destroy reversible?
Terraform destroy is not reversible in the strict sense: once resources are destroyed, the underlying provider removes them and Terraform cannot automatically restore their previous state. You can usually recreate the infrastructure by running terraform apply again with the same configuration, but any data is only recoverable if you have independent backups or snapshots.
The state file is Terraform’s source of truth when performing any operation. If the state file is corrupted, Terraform can behave in unwarranted ways. If the state file does not mention a certain resource—but the resource exists in the real world—then running terraform destroy will NOT destroy that resource.
How do I destroy only one resource?
The recommended approach is to update your configuration and apply the change: remove the resource from your Terraform code or change the configuration so it is no longer needed, review the execution plan, and then run terraform apply so Terraform can clean it up safely. Using targeted operations such as terraform destroy -target=resource_type.name should be reserved for exceptional situations because they can lead to unexpected behavior and partial state changes.
Run terraform destroy – without Terraform--target argument. After successful destruction, import the target resources back in the state file. This post describes how to import cloud resources under Terraform.
Terraform destroy vs. terraform state rm
Unlike terraform destroy, terraform state rm doesn’t actually delete resources from the infrastructure. Running terraform state rm lets Terraform know that some of the resources are no longer managed by Terraform. When destroy is executed, Terraform does not touch those resources. When the cleanup of other resources is done, and the remaining resources are imported back, Terraform then manages the resources again.
Production Use And Safety Considerations
Should I ever use terraform destroy in production?
Terraform destroy can be used in production, but only in controlled scenarios such as decommissioning an entire environment or shutting down an ephemeral stack.
Use this feature carefully, as destroying a single resource may break dependencies or state consistency if other resources depend on it. Always run terraform plan first to verify the impact.
The -target option is not for routine use, and is provided only for exceptional situations such as recovering from errors or mistakes, or when Terraform specifically suggests to use it as part of an error message.
In short: use -target only for exceptional debugging or emergency fixes. If it’s part of your normal deployment process, your project layout probably needs refactoring.
Before running terraform destroy you should review the changes and verify the execution plan using terraform plan -destroy. Once executed, terraform destroy permanently deletes the targeted resources.
Failure Modes And Operational Risks
Why did Terraform destroy fail?
There are many reasons why a Terraform destroy operation may fail.
- RBAC | Terraform destroy will fail if the role/account you are using doesn’t have enough permissions to delete the resources.
- Locked state | When the state is locked, you won’t be able to run operations against your state, and you will need to wait for it to be available.
- Network issues | If you have any connectivity issues, your delete requests may not arrive properly.
- Syntax errors | If you have made changes to your code that have syntax errors, terraform destroy won’t run until you fix them
When the destroy command is executed, Terraform first validates the information contained in the state file by cross-checking with cloud provider APIs. Internally it builds a dependency graph to identify the sequence in which the resources are to be destroyed.
The state file is Terraform’s source of truth when performing any operation. If the state file is corrupted, Terraform can behave in unwarranted ways.
Note: terraform destroy only affects resources in the current state file and backend. If you have multiple workspaces or backends, you must destroy each independently.
Targeting In Plan And Apply Context
The -target flag lets you apply or destroy specific resources instead of processing the entire Terraform state.
This limits the plan to only the specified resources and their dependencies.
For example, to reference a VM only:
terraform plan -target=azurerm_linux_virtual_machine.example
Read more about targeting resources with terraform plan.
terraform apply -target syntax:
terraform apply -target=<resource_type.resource_name>
The -target flag is an underrated yet powerful feature that allows precise control over infrastructure changes. If you've ever struggled with lengthy terraform apply runs or wanted to destroy a single resource without affecting the rest of your infrastructure, this guide is for you.
Let’s dive deep into terraform apply -target and terraform destroy -target, uncovering lesser-known facts that make them awesome tools in your DevOps arsenal.
While useful, improper use -target can lead to an inconsistent Terraform state if not handled carefully.
Conclusion
Terraform destroy target operations provide surgical control over infrastructure deletion, but the control comes with state consistency risks. The -target flag limits planning and execution to a named resource and its dependencies, which enables faster iteration and selective debugging. The execution plan warning explicitly states that resource targeting is in effect and the result of this plan may not represent all of the changes requested by the current configuration.
The destroy workflow validates state against provider APIs, builds a dependency graph, and permanently deletes resources in the current state file and backend only. Irreversibility is inherent: once the provider removes resources, Terraform cannot automatically restore them, and recovery requires recreation from configuration plus independent backups or snapshots for data.
Safe use demands pre-execution verification with terraform plan -destroy, awareness that the state file is the source of truth, and recognition that corrupted state or drift between state and reality can cause unwarranted behavior. Targeted destroy should be reserved for exceptional situations such as recovering from errors or mistakes, or when Terraform specifically suggests to use it as part of an error message. Normal destruction is better achieved by removing the resource from configuration and applying the change, which preserves dependency handling.
Operational options like -auto-approve enable non-interactive destruction for ephemeral environments in CI/CD pipelines, while -refresh=false forces destruction based solely on state without pre-refresh, a choice that requires full trust in state accuracy. Failures commonly stem from insufficient RBAC permissions, state locks, network issues, or syntax errors.
In production, terraform destroy is acceptable only in controlled scenarios such as decommissioning an entire environment or shutting down an ephemeral stack. Targeted destruction of a single resource can break dependencies and produce partial state changes, which is why the recommended approach for removing a single resource is configuration removal followed by apply, with terraform destroy -target reserved for exceptional debugging or emergency fixes.