Create_before_destroy lifecycle rule in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the effect of create_before_destroy in Terraform lifecycle

Given the following Terraform resource configuration, what will happen when the resource is updated?

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

A Terraform will update the existing instance in place without replacement.

B Terraform will destroy the old instance first, then create a new one.

C Terraform will create a new instance before destroying the old one during updates.

D Terraform will fail to apply because create_before_destroy is invalid here.

💡 Hint

Think about what the create_before_destroy lifecycle rule means for resource replacement.

The create_before_destroy lifecycle rule tells Terraform to create the replacement resource before destroying the existing one. This helps avoid downtime during resource replacement.

❓ Architecture

intermediate

Choosing lifecycle rules for zero downtime deployment

You want to update a cloud resource with zero downtime. Which lifecycle configuration should you use in Terraform?

A lifecycle { create_before_destroy = true }

B lifecycle { ignore_changes = ["ami"] }

C lifecycle { replace_triggered_by = ["aws_instance.example"] }

D lifecycle { prevent_destroy = true }

💡 Hint

Which lifecycle rule ensures the new resource is ready before the old one is removed?

The create_before_destroy rule ensures Terraform creates the new resource before destroying the old one, enabling zero downtime updates.

❓ service_behavior

advanced

Effect of create_before_destroy on resource dependencies

Consider two Terraform resources where one depends on the other. If the dependent resource has create_before_destroy = true, what is the expected behavior during replacement?

Terraform

resource "aws_lb" "example_lb" {
  name = "example-lb"
}

resource "aws_lb_listener" "example_listener" {
  load_balancer_arn = aws_lb.example_lb.arn
  port              = 80
  protocol          = "HTTP"

  lifecycle {
    create_before_destroy = true
  }
}

A Terraform destroys the old listener before creating the new one, causing downtime.

B Terraform fails to apply due to circular dependency caused by create_before_destroy.

C Terraform ignores the lifecycle rule because dependencies override it.

D Terraform creates the new listener before destroying the old one, ensuring the load balancer is not disrupted.

💡 Hint

Think about how create_before_destroy affects dependent resources and their availability.

The create_before_destroy lifecycle rule on the listener resource causes Terraform to create the new listener before destroying the old one, maintaining service availability.

❓ security

advanced

Security implications of create_before_destroy lifecycle rule

What is a potential security risk when using create_before_destroy = true for resources like IAM roles or security groups?

A Terraform will delete permissions before creating new ones, causing access loss.

B Temporary duplication of permissions may exist, increasing attack surface.

C The lifecycle rule disables encryption on the resource during replacement.

D There is no security risk; create_before_destroy only affects resource timing.

💡 Hint

Consider what happens when two versions of a sensitive resource exist simultaneously.

Using create_before_destroy can cause temporary duplication of sensitive resources like IAM roles, potentially increasing the attack surface until the old resource is destroyed.

✅ Best Practice

expert

Troubleshooting create_before_destroy causing apply failure

You have a Terraform resource with create_before_destroy = true. When applying, Terraform fails with a "resource already exists" error. What is the most likely cause?

A The new resource uses the same unique identifier as the old one, causing a conflict.

B Terraform does not support create_before_destroy for this resource type.

C The lifecycle block is missing the prevent_destroy setting.

D The old resource was manually deleted outside Terraform, causing state mismatch.

💡 Hint

Think about what happens when two resources with the same unique ID exist simultaneously.

If the new resource tries to use the same unique identifier as the old one, create_before_destroy causes a conflict because both exist at the same time. The solution is to ensure unique IDs or use other strategies.