Terraform target validation issue

[mikellealboretto-byte]

Terraform Version

terraform version
Terraform v1.13.4
on linux_amd64

Terraform Configuration Files

module "xen_vm" {
  for_each = local.vms
  source   = "./modules/xen"
  
  name        = each.key
  vcpus       = each.value.cpu
  memory      = each.value.ram
  disks       = each.value.disks
  networks    = each.value.networks
  host_name   = each.value.host_name
}

Debug Output

terraform -chdir=terraform apply -target='module.xen_vm[\"some-vm\"].xenorchestra_vm.vm' some.tfplan

Expected Behavior

terraform will apply the one single resource changes

Actual Behavior

module.powerdns_records["some-other-vm-15"].powerdns_record.a-record[0]: Destruction complete after 0s
module.xen_vm["some-other-vm-06"].xenorchestra_vm.vm: Modifying... [id=da1351c6-e522-92e0-ffb9-a8cf86b13351]

tf run apply for all the resources in plan file

Steps to Reproduce

1. terraform init - fresh state, completely new dir
2. terraform -chdir=terraform plan -parallelism=15 -out=some.tfplan
3. terraform -chdir=terraform apply -target='module.xen_vm[\"some-vm\"].xenorchestra_vm.vm' some.tfplan

Additional Context

Seems here is the problem with target pointing

References

No response

Generative AI / LLM assisted development?

no

[mikellealboretto-byte]

Here is the repo to reproduce an issue https://github.com/mikellealboretto-byte/learn-terraform-resource-targeting-failure.git

[jbardin]

Hi @mikellealboretto-byte,

Thanks for filing the issue. This does seem to be a validation issue. You cannot apply -target to an already created plan, that set of planned changes are already defined, and terraform will ignore additional target inputs. So the result you have is technically correct if you were to apply it, but I would expect an error of some sort indicating the invalid use of -target.

[mikellealboretto-byte]

Hi @mikellealboretto-byte,

Thanks for filing the issue. This does seem to be a validation issue. You cannot apply -target to an already created plan, that set of planned changes are already defined, and terraform will ignore additional target inputs. So the result you have is technically correct if you were to apply it, but I would expect an error of some sort indicating the invalid use of -target.

Hi @jbardin,
This is crucial because when Terraform runs based on a plan file, no change notifications are generated. Therefore, technically, all changes are applied without further confirmation.
This is very dangerous.