Error: Invalid resource instance data in state: "could not be decoded from the state"

TL;DR

The provider version you are running is older than the one that wrote the state, and the state contains an attribute the old provider does not know. Upgrade (or pin) the provider to the version that wrote the state, usually the newest, then re-run.

The error

Error: Invalid resource instance data in state

  on /path/to/configuration/file.tf line 1:
  16: resource "resource_type" "resource_name" {

Instance resource_type.resource_name data could not be decoded from the
state: unsupported attribute "unknown_attribute_name".

Steps to fix

1. Compare provider versions: run terraform version and check what is installed vs what the lock file pins vs what wrote the state (ask the teammate/CI that last applied).

• Expected: you find a version skew, e.g. state written by provider v4 while you run v3.

1. Align on the newer provider: update the version constraint, run terraform init -upgrade.

• Expected: the installed provider knows the attribute and decodes the state.

1. Commit .terraform.lock.hcl so every machine and CI uses the same provider version.

• Expected: no more skew between workstations and pipeline.

1. Re-run terraform plan.

• Expected: state decodes cleanly.

When to use this

• plan, apply, or import fails with Invalid resource instance data in state ... unsupported attribute after a provider upgrade/downgrade or when a different machine runs with an older provider.

When NOT to use this

• Unsupported attribute in configuration is a config bug; this error is about state decoding. Do not hand-edit the state file to remove the attribute.

Compatibility

• All Terraform versions; triggered by provider schema changes across versions (e.g. Twingate provider v3 to v4, AWS provider major bumps).

Root cause

State records the full attribute set the writing provider's schema knew. When an older provider loads that state, its schema lacks the newer attribute and decoding fails. The state is fine; the reader is too old.

Edge cases

• Importing with an older provider than the one managing the existing state hits the same error; pin versions before importing.
• Downgrading a provider after an upgrade leaves the new attributes in state; upgrade again or restore a pre-upgrade state backup.
• If CI and local differ, the lock file is the fix: commit it and stop running init -upgrade casually.