title: Remove IAM user from group in terraform state file
body: <p>I have an AWS IAM user and group managed by Terraform 12.5. I am trying to migrate management from one Terraform code base to another, but I can't disrupt the actual resources. I can remove the user from the state file with:</p>
  
  <pre><code>terraform state rm aws_iam_user.testuser
  </code></pre>
  
  <p>In addition to removing the user from the state file, I want to remove the user's group membership from the state file. But the user remains in the "aws_iam_group_membership" resource after the "aws_iam_user" resource has been removed.</p>
  
  <p>I have tried several things to remove the user from the "aws_iam_group_membership" resource, but only get syntax errors.</p>
  
  <p>I suspect that the resource instance address I am using is wrong or this is not possible using state rm.</p>
  
  <p>I try things like:</p>
  
  <pre><code>terraform state rm aws_iam_group_membership.testgroup-group-membership.testuser
  
  Error: Invalid address
  
    on  line 1:
    (source code not available)
  
  Resource instance key must be given in square brackets.
  
  or
  
  terraform state rm aws_iam_group_membership.testgroup-group-membership[testuser]
  
  Error: Index value required
  
    on  line 1:
    (source code not available)
  
  Index brackets must contain either a literal number or a literal string.
  
  or
  
  terraform state rm aws_iam_group_membership.testgroup-group-membership[0]
  No matching resource instances found.
  </code></pre>
  
  <p>It's not clear exactly what constitutes an instance of "aws_iam_group_membership". The state file shows this:</p>
  
  <pre><code>{
    "mode": "managed",
    "type": "aws_iam_group_membership",
    "name": "testgroup-group-membership",
    "provider": "provider.aws",
    "instances":
      {   
        "schema_version": 0,
        "attributes": {
          "group": "testgroup",
          "id": "testgroup-group-membership",
          "name": "testgroup-group-membership",
          "users": [
            "testuser",
            "testuser2",
            "testuser3"
          ]   
        },  
        "private": "foobar==",
        "depends_on": [
          "aws_iam_group.testgroup",
          "aws_iam_user.testuser",
          "aws_iam_user.testuser2",
          "aws_iam_user.testuser3"
        ]   
      }   
    ]
  }
  </code></pre>
  
  <p>This is similar to what's in the state file for the user:</p>
  
  <pre><code>{
    "mode": "managed",
    "type": "aws_iam_user",
    "name": "testuser",
    "provider": "provider.aws",
    "instances": [
      {   
        "schema_version": 0,
        "attributes": {
          "arn": "arn:aws:iam::1111111111111:user/testuser",
          "force_destroy": null,
          "id": "testuser",
          "name": "testuser",
          "path": "/",
          "permissions_boundary": null,
          "tags": {}, 
          "unique_id": "AIDAAAAAAAAAAAAAAAAAZS"
        },  
        "private": "foobar=="
      }   
    ]
  },
  </code></pre>
  
  <p>"instances" contains things like "schema_version", "attributes", "private", "depends_on".</p>
  
  <p>But for AWS IAM users I believe "testuser" is an instance of "aws_iam_user"? Or maybe not. Maybe you can't have multiple instances of an AWS IAM user like you can with servers?</p>
  
  <p>That would make "testgroup-group-membership" an instance of "aws_iam_group_membership"?</p>
  
  <p>That would mean that running the following would remove the entire list of users who are members of the group?</p>
  
  <pre><code>terraform state rm aws_iam_group_membership.testgroup-group-membership
  </code></pre>
  
  <p>Because the set of user members is an instance of "aws_iam_group_membership"? Users themselves aren't instances?</p>
  
  <p>The question is, how do I remove a user from a group in a terraform state file while leaving the actual resources untouched?</p>
  
  <p>I don't want to manually edit the state file for a variety of reasons. For one, it's stored in S3 with a DynamoDB hash lock. And every time I've tried to manually edit the state file, it's gone horribly wrong.</p>