Terraform Targeting Limits: Is `-target` Safe for Incident Response?

Targeting Limits

Terraform’s -target flag lets a plan or apply focus on specific resource addresses. It is presented as a break‑glass or compatibility option, not a routine deployment pattern. In a state‑backed workspace, targeting limits the graph traversal to the chosen objects and their immediate dependencies, while the rest of the configuration is left untouched.

Because untargeted resources are omitted from the plan, Terraform does not refresh or evaluate their state. This can mask drift, skip upstream changes, or leave partially applied dependency chains. The command may emit warnings, but it does not enforce dependency safety, and the resulting state can diverge from the full configuration.

These behaviors raise an open operational decision: should CI or incident‑response pipelines be allowed to use -target for quick fixes, or should they enforce a full plan/apply to guarantee completeness? The choice depends on blast radius, state backend, and provider dependencies, but no official guidance resolves the trade‑offs.

1. Does -target skip refresh of untargeted resources, potentially hiding drift?
2. Will a targeted apply leave partially applied dependency chains, and how does Terraform warn about this?
3. Should CI pipelines permit -target for incident fixes, or enforce full plan/apply to avoid hidden changes?