Update and Destroy Infrastructure

This lesson focuses on two essential lifecycle operations in Terraform: updating existing infrastructure to match changed requirements, and safely removing resources when they are no longer needed. Real environments change regularly—Terraform models the desired end state and produces safe, predictable plans to reconcile your cloud resources with that state. Below you’ll find clear examples showing:

an initial Azure resource group configuration,
how Terraform plans and applies an in-place update when you add tags,
how Terraform shows a destroy plan and performs destruction,
how multiple resources interact during updates and removals,
and what the state file looks like after a full destroy.

For further reading, see the Terraform documentation: https://www.terraform.io/docs and the Azure Provider docs: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs

Terraform models desired state rather than imperative commands. Always run terraform plan before terraform apply to review what will change, and keep your state file backed up or versioned.

Initial configuration

Here is a minimal Terraform configuration that configures the Azure provider and creates one resource group.

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "rg" {
  name     = "my-workshop-rg"
  location = "East US"
}

When you run terraform apply the first time, Terraform compares this configuration to the current Azure state. Since the resource group does not yet exist, Terraform will create it.

Updating resources (adding tags)

Suppose you modify the same resource group to include tags. Terraform will compare the desired state (your HCL) with the current state and plan an in-place update if the provider supports updating the attribute without replacement. Updated configuration with a tags block:

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "rg" {
  name     = "my-workshop-rg"
  location = "East US"

  tags = {
    Owner = "Workshop"
  }
}

Running terraform plan will show the detected change as an in-place update. The tilde (~) symbol means “update in-place”. Example plan output:

$ terraform plan
azurerm_resource_group.rg: Refreshing state...
[id=/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/my-workshop-rg]

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # azurerm_resource_group.rg will be updated in-place
  ~ resource "azurerm_resource_group" "rg" {
      id   = "/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/my-workshop-rg"
      name = "my-workshop-rg"
      ~ tags = {
          + "Owner" = "Workshop"
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

The plan clearly indicates which attribute will change (Owner tag) and confirms the resource will be modified in-place instead of being replaced.

Quick reference: plan symbols

Symbol	Meaning
`+`	Create (resource/attribute will be added)
`~`	Update in-place (resource remains, attributes change)
`-`	Destroy (resource/attribute will be removed)

Note: Whether an attribute change causes an in-place update or a full replacement depends on the provider and the specific attribute. For details check the Azure provider docs.

Destroying resources

To remove managed resources from Azure, use terraform destroy. Terraform will build a destroy plan showing resources that will be removed; a minus (-) symbol denotes destruction. If the entire resource is scheduled for removal, the minus applies to the resource block; if just an attribute is removed from the configuration, the minus may apply only to that attribute. Example interactive terraform destroy output:

$ terraform destroy
azurerm_resource_group.rg: Refreshing state...
[id=/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/my-workshop-rg]

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # azurerm_resource_group.rg will be destroyed
  - resource "azurerm_resource_group" "rg" {
      id       = "/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/my-workshop-rg"
      location = "eastus" -> null
      name     = "my-workshop-rg" -> null
      tags     = {} -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Do you really want to destroy all resources?
Terraform will destroy all your managed infrastructure, as shown above.
There is no undo. Only 'yes' will be accepted to confirm.

Enter a value: yes
azurerm_resource_group.rg: Destroying...
azurerm_resource_group.rg: Destruction complete after 16s
Destroy complete! Resources: 1 destroyed.

Destroy is destructive and irreversible through Terraform. Always review the plan carefully and ensure you have backups or snapshots if required.

Working with multiple resources

Real-world Terraform configurations typically manage many resources together. The example below shows a storage account and a virtual network managed alongside a resource group.

resource "azurerm_storage_account" "sa" {
  name                     = "stkodekloudfsa45778"
  resource_group_name      = "kodekloud-tf-rg"
  location                 = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_virtual_network" "vnet" {
  name                = "kodekloud-tf-vnet"
  resource_group_name = "kodekloud-tf-rg"
  location            = "eastus"
  address_space       = ["10.0.0.0/16"]
}

Applying these resources:

terraform apply --auto-approve
azurerm_resource_group.rg: Modifying... [id=/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/kodekloud-tf-rg]
azurerm_virtual_network.vnet: Creating...
azurerm_storage_account.sa: Creating...
azurerm_resource_group.rg: Modifications complete after 2s [id=/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/kodekloud-tf-rg]
azurerm_virtual_network.vnet: Creation complete after 7s [id=/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/kodekloud-tf-rg/providers/Microsoft.Network/virtualNetworks/kodekloud-tf-vnet]
azurerm_storage_account.sa: Still creating... [10s elapsed]
azurerm_storage_account.sa: Still creating... [20s elapsed]
azurerm_storage_account.sa: Still creating... [30s elapsed]
azurerm_storage_account.sa: Creation complete after 1m12s
Apply complete! Resources: 2 added, 1 changed, 0 destroyed.

If you later remove the storage account block from your configuration and update resource group tags, terraform plan will present both an in-place update and a planned destroy for the storage account:

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # azurerm_resource_group.rg will be updated in-place
  ~ resource "azurerm_resource_group" "rg" {
      id   = "/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/kodekloud-tf-rg"
      ~ tags = {
          + "environment" = "testing"
        }
    }

  # azurerm_storage_account.sa will be destroyed
  - resource "azurerm_storage_account" "sa" {
      - id       = "/subscriptions/1b228746-75fd-46ed-8a6b-6a9066d6d3a3/resourceGroups/kodekloud-tf-rg/providers/Microsoft.Storage/storageAccounts/stkodekloudtfsa45778" -> null
      - name     = "stkodekloudtfsa45778" -> null
      - location = "eastus" -> null
      # (other attributes hidden)
    }

Plan: 0 to add, 1 to change, 1 to destroy.

If your goal is simply to remove all resources managed in state without editing the configuration, terraform destroy will remove everything after confirmation.

State file after a full destroy

After successfully destroying all managed resources, Terraform updates the state file. A state file showing no managed resources will have an empty resources array, for example:

{
  "version": 4,
  "terraform_version": "1.5.7",
  "serial": 9,
  "lineage": "0753e9c2-a985-24ba-0ebd-ea12e056aa6f",
  "outputs": {},
  "resources": []
}

You can also verify in the Azure portal that the resource group and its related resources have been removed.

The image shows a Microsoft Azure portal page displaying a list of resource groups, along with their corresponding subscriptions and locations. The interface includes options to create, refresh, export, and filter the resource groups.

Links and references

Terraform: https://www.terraform.io/docs
Azure Provider (azurerm): https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
Azure Portal: https://portal.azure.com

Introduction

Infrastructure as Code Fundamentals

Terraform Cloud

Setting up environment

Azure Context for Terraform

HashiCorp Configuration Language

Terraform Providers

Variables

Outputs and Dependencies

Iteration and Logic

Advanced Constructs

Terraform State Fundamentals

Remote State

Terraform Workspaces

Terraform CLI

Lifecycle Meta-Arguments

Data Sources

Provisioners

Debugging Terraform

Terraform Modules

Azure DevOps Integration

Azure Pipelines for Terraform

Update and Destroy Infrastructure

Initial configuration

Updating resources (adding tags)

Quick reference: plan symbols

Destroying resources

Working with multiple resources

State file after a full destroy

Links and references

Watch Video

​Initial configuration

​Updating resources (adding tags)

​Quick reference: plan symbols

​Destroying resources

​Working with multiple resources

​State file after a full destroy

​Links and references

Watch Video

Initial configuration

Updating resources (adding tags)

Quick reference: plan symbols

Destroying resources

Working with multiple resources

State file after a full destroy

Links and references