terraform: tainted things all work

terraform/context.go

@@ -620,8 +620,13 @@ func (c *Context) applyWalkFn() depgraph.WalkFunc {
 			}
 		}
 
-		// Update the primary instance
+		if r.Tainted && r.TaintedIndex > -1 {
+			// Update the tainted resource.
+			r.State.Tainted[r.TaintedIndex] = is
+		} else {
+			// Update the primary resource
 			r.State.Primary = is
+		}
 
 		// Update the resulting diff
 		c.sl.Lock()
@@ -760,7 +765,7 @@ func (c *Context) planWalkFn(result *Plan) depgraph.WalkFunc {
 
 	cb := func(r *Resource) error {
 		if r.Tainted && r.TaintedIndex > -1 {
-			// No-op this. We somewhat magically diff this later.
+			// We don't diff tainted resources.
 			return nil
 		}
 
@@ -807,7 +812,7 @@ func (c *Context) planWalkFn(result *Plan) depgraph.WalkFunc {
 		if r.Tainted {
 			// Tainted resources must also be destroyed
 			log.Printf("[DEBUG] %s: Tainted, marking for destroy", r.Id)
-			diff.Destroy = true
+			diff.DestroyTainted = true
 		}
 
 		if diff.RequiresNew() && is != nil && is.ID != "" {

terraform/diff.go

@@ -99,7 +99,7 @@ func (d *Diff) String() string {
 		rdiff := d.Resources[name]
 
 		crud := "UPDATE"
-		if rdiff.RequiresNew() && rdiff.Destroy {
+		if rdiff.RequiresNew() && (rdiff.Destroy || rdiff.DestroyTainted) {
 			crud = "DESTROY/CREATE"
 		} else if rdiff.Destroy {
 			crud = "DESTROY"
@@ -156,6 +156,7 @@ func (d *Diff) String() string {
 type InstanceDiff struct {
 	Attributes     map[string]*ResourceAttrDiff
 	Destroy        bool
+	DestroyTainted bool
 
 	once sync.Once
 }

terraform/graph.go

@@ -338,6 +338,9 @@ func graphAddDiff(g *depgraph.Graph, d *Diff) error {
 		if !ok {
 			continue
 		}
+		if rn.Resource.Tainted && rn.Resource.TaintedIndex > -1 {
+			continue
+		}
 
 		rd, ok := d.Resources[rn.Resource.Id]
 		if !ok {