Terraform AWS provider "couldn't find resource" (404 on read) in CI

By Daniel Zoghalchali·Latchkey

During refresh the AWS provider asked AWS for a resource recorded in state and got a 404. The resource was deleted out of band, so state and reality disagree.

What this error means

A plan or apply fails (or the provider warns) with "Error: reading <Resource> (<id>): couldn't find resource" or a 404/NotFound for an id Terraform still tracks.

Terraform

Error: reading EC2 Instance (i-0abc123): couldn't find resource

Error: reading IAM Role (deploy): operation error IAM: GetRole, https
response error StatusCode: 404, api error NoSuchEntity: The role with
name deploy cannot be found.

Common causes

The resource was deleted outside Terraform

A console action, another tool, or an account cleanup removed the resource while it remained in this state.

A read on a not-yet-consistent resource

Just after creation a resource may not be immediately readable in another path, surfacing a transient 404 on refresh.

How to fix it

Drop the stale resource from state

If the resource is genuinely gone, remove it from state so Terraform plans to recreate it instead of erroring on read.

Terminal

terraform state rm aws_instance.app
terraform apply

Refresh to reconcile state

Run a refresh-style plan so Terraform reconciles state with AWS.
For a resource deleted out of band, let Terraform plan its recreation.
For a transient read, re-run; consistent 404s mean the resource is truly gone.

Terminal

terraform plan -refresh-only

How to prevent it

Avoid deleting Terraform-managed resources from the console.
Run refresh-only plans to catch drift before apply.
Treat consistent read 404s as out-of-band deletes, not flakes.

Frequently asked questions

What causes ""couldn't find resource""?