Create_before_destroy lifecycle rule in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the effect of create_before_destroy in Terraform lifecycle

Given the following Terraform resource configuration, what will happen when the resource is updated?

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

A Terraform will update the existing instance in place without replacement.

B Terraform will destroy the old instance first, then create a new one.

C Terraform will create a new instance before destroying the old one during updates.

D Terraform will fail to apply because create_before_destroy is invalid here.

💡 Hint

Think about what the create_before_destroy lifecycle rule means for resource replacement.

The create_before_destroy lifecycle rule tells Terraform to create the replacement resource before destroying the existing one. This helps avoid downtime during resource replacement.

❓ Architecture

intermediate

Choosing lifecycle rules for zero downtime deployment

You want to update a cloud resource with zero downtime. Which lifecycle configuration should you use in Terraform?

A lifecycle { create_before_destroy = true }

B lifecycle { ignore_changes = ["ami"] }

C lifecycle { replace_triggered_by = ["aws_instance.example"] }

D lifecycle { prevent_destroy = true }

💡 Hint

Which lifecycle rule ensures the new resource is ready before the old one is removed?

The create_before_destroy rule ensures Terraform creates the new resource before destroying the old one, enabling zero downtime updates.

❓ service_behavior

advanced

Effect of create_before_destroy on resource dependencies

Consider two Terraform resources where one depends on the other. If the dependent resource has create_before_destroy = true, what is the expected behavior during replacement?

Terraform

resource "aws_lb" "example_lb" {
  name = "example-lb"
}

resource "aws_lb_listener" "example_listener" {
  load_balancer_arn = aws_lb.example_lb.arn
  port              = 80
  protocol          = "HTTP"

  lifecycle {
    create_before_destroy = true
  }
}

A Terraform destroys the old listener before creating the new one, causing downtime.

B Terraform fails to apply due to circular dependency caused by create_before_destroy.

C Terraform ignores the lifecycle rule because dependencies override it.

D Terraform creates the new listener before destroying the old one, ensuring the load balancer is not disrupted.

💡 Hint

Think about how create_before_destroy affects dependent resources and their availability.

The create_before_destroy lifecycle rule on the listener resource causes Terraform to create the new listener before destroying the old one, maintaining service availability.

❓ security

advanced

Security implications of create_before_destroy lifecycle rule

What is a potential security risk when using create_before_destroy = true for resources like IAM roles or security groups?

A Terraform will delete permissions before creating new ones, causing access loss.

B Temporary duplication of permissions may exist, increasing attack surface.

C The lifecycle rule disables encryption on the resource during replacement.

D There is no security risk; create_before_destroy only affects resource timing.

💡 Hint

Consider what happens when two versions of a sensitive resource exist simultaneously.

Using create_before_destroy can cause temporary duplication of sensitive resources like IAM roles, potentially increasing the attack surface until the old resource is destroyed.

✅ Best Practice

expert

Troubleshooting create_before_destroy causing apply failure

You have a Terraform resource with create_before_destroy = true. When applying, Terraform fails with a "resource already exists" error. What is the most likely cause?

A The new resource uses the same unique identifier as the old one, causing a conflict.

B Terraform does not support create_before_destroy for this resource type.

C The lifecycle block is missing the prevent_destroy setting.

D The old resource was manually deleted outside Terraform, causing state mismatch.

💡 Hint

Think about what happens when two resources with the same unique ID exist simultaneously.

If the new resource tries to use the same unique identifier as the old one, create_before_destroy causes a conflict because both exist at the same time. The solution is to ensure unique IDs or use other strategies.

Practice

1. What is the main purpose of the create_before_destroy lifecycle rule in Terraform?

easy

A. To create a new resource before deleting the old one to avoid downtime

B. To destroy resources before creating new ones to save costs

C. To prevent any resource from being created or destroyed

D. To automatically backup resources before deletion

Solution

1. Step 1: Understand lifecycle behavior

   The create_before_destroy rule tells Terraform to create the replacement resource first.

2. Step 2: Avoid downtime during updates

   This ensures the old resource is only destroyed after the new one is ready, preventing service interruption.

3. Final Answer:

   To create a new resource before deleting the old one to avoid downtime -> Option A

4. Quick Check:

   create_before_destroy = avoid downtime [OK]

Hint: Remember: create new first, then delete old [OK]

Common Mistakes:

• Thinking it deletes old resource before creating new
• Confusing with prevent_destroy lifecycle rule
• Assuming it backs up resources automatically

2. Which of the following is the correct syntax to enable create_before_destroy in a Terraform resource?

easy

A. lifecycle { create_before_destroy = true }

B. lifecycle { create_before_destroy: true }

C. lifecycle = { create_before_destroy = true }

D. lifecycle { create_before_destroy = "true" }

Solution

1. Step 1: Review Terraform lifecycle block syntax

   The lifecycle block uses curly braces with key-value pairs using = and booleans without quotes.

2. Step 2: Identify correct boolean assignment

   Boolean values are unquoted, so true is correct, not "true" as string.

3. Final Answer:

   lifecycle { create_before_destroy = true } -> Option A

4. Quick Check:

   Correct syntax uses = and unquoted booleans [OK]

Hint: Use = and true without quotes in lifecycle block [OK]

Common Mistakes:

• Using colon : instead of equals =
• Putting boolean true in quotes
• Assigning lifecycle block with = instead of braces

3. Given this Terraform resource snippet, what will happen during an update?

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

medium

A. Terraform will destroy the old instance before creating the new one

B. Terraform will fail because create_before_destroy is not supported

C. Terraform will update the instance in place without replacement

D. Terraform will create the new instance before destroying the old one

Solution

1. Step 1: Check lifecycle rule effect

   The create_before_destroy = true means Terraform creates the new resource first.

2. Step 2: Understand resource replacement

   Since the instance requires replacement, Terraform creates new instance before destroying old one.

3. Final Answer:

   Terraform will create the new instance before destroying the old one -> Option D

4. Quick Check:

   create_before_destroy = new before old [OK]

Hint: If replacement needed, new resource comes first [OK]

Common Mistakes:

• Assuming old resource is destroyed first
• Thinking update happens in place always
• Believing create_before_destroy is unsupported

4. You added create_before_destroy = true to a resource but Terraform still destroys the old resource before creating the new one. What is the likely cause?

medium

A. You used quotes around true in lifecycle block

B. The resource does not support create_before_destroy lifecycle rule

C. You forgot to run terraform init

D. Terraform always destroys before creating regardless of lifecycle

Solution

1. Step 1: Understand resource support

   Not all Terraform resources support create_before_destroy. If unsupported, Terraform ignores it.

2. Step 2: Check lifecycle behavior fallback

   If unsupported, Terraform defaults to destroying old resource before creating new one.

3. Final Answer:

   The resource does not support create_before_destroy lifecycle rule -> Option B

4. Quick Check:

   Unsupported resource ignores create_before_destroy [OK]

Hint: Check resource docs for create_before_destroy support [OK]

Common Mistakes:

• Assuming terraform init fixes lifecycle issues
• Using quotes around boolean true
• Believing lifecycle rules always override resource behavior

5. You manage a critical database server resource that must never be unavailable during updates. How should you configure Terraform to ensure zero downtime using create_before_destroy?

hard

A. Remove lifecycle block and rely on default behavior

B. Use prevent_destroy = true to stop any deletion

C. Add lifecycle { create_before_destroy = true } and verify the resource supports it

D. Manually delete old resource before applying changes

Solution

1. Step 1: Use create_before_destroy for zero downtime

   Setting create_before_destroy = true ensures new resource is ready before old is removed.

2. Step 2: Confirm resource supports lifecycle rule

   Check documentation to ensure the database resource supports this lifecycle feature to avoid unexpected downtime.

3. Final Answer:

   Add lifecycle { create_before_destroy = true } and verify the resource supports it -> Option C

4. Quick Check:

   Use create_before_destroy with support check [OK]

Hint: Always verify resource supports create_before_destroy [OK]

Common Mistakes:

• Using prevent_destroy which blocks updates
• Relying on default lifecycle risking downtime
• Manually deleting resources causing downtime