Terraform Associate: Maintain infrastructure with Terraform

Maintaining infrastructure means handling drift, upgrades, refactors and partial failures without destroying data.

Drift - real infrastructure changed outside Terraform. terraform plan surfaces it (refresh runs as part of plan); terraform apply -refresh-only updates state without changing real resources; -refresh=false skips it entirely (rarely what you want).
Forced replacement - terraform apply -replace=aws_instance.web is the current mechanism; terraform taint is deprecated in its favor. terraform untaint reverses a taint.
Refactoring - moved { from = ... to = ... } blocks or terraform state mv change addresses without recreation. import { to = ..., id = ... } blocks (Terraform 1.5+) adopt existing objects declaratively; -generate-config-out=file.tf drafts matching configuration for you to review.
Upgrades - raise required_version or provider constraints, run terraform init -upgrade, read the changelog, then read the plan closely: provider majors often force replacements.
Diagnostics - TF_LOG=DEBUG (or TRACE) and TF_LOG_PATH for logs.
Pipeline discipline - fmt -check, validate, plan -out, human approval, then apply the saved plan. Never apply from a laptop against production state.

import alone does not write or fix configuration, and imported attributes are not validated against the block.
-replace causes real downtime or data loss if the resource is stateful.
A stale lock after a crashed run needs force-unlock, not a manually deleted lock row.

Before approving any apply, scan the plan summary line for 0 to add, 0 to change, 0 to destroy versus replacement and destroy counts.