Depends_on for explicit dependencies in Terraform - Deep Dive

Overview - Depends_on for explicit dependencies

What is it?

Depends_on is a feature in Terraform that lets you tell it exactly which resources must be created or updated before others. It helps control the order of resource actions when Terraform cannot figure it out automatically. This is useful when resources have hidden or complex relationships. Without depends_on, Terraform might try to create or change things in the wrong order, causing errors.

Why it matters

Terraform usually figures out the order to create resources by looking at references between them. But sometimes, resources depend on each other in ways Terraform can't see. Without depends_on, Terraform might try to create a resource too early, causing failures or inconsistent setups. Using depends_on ensures your infrastructure builds in the right order, avoiding downtime or broken systems.

Where it fits

Before learning depends_on, you should understand basic Terraform concepts like resources, variables, and how Terraform builds a dependency graph automatically. After mastering depends_on, you can explore advanced Terraform features like modules, lifecycle rules, and complex orchestration patterns.

Mental Model

Core Idea

Depends_on explicitly tells Terraform which resources must finish before others start, ensuring the correct creation order.

Think of it like...

Imagine baking a cake where you must bake the cake layers before frosting them. Depends_on is like a recipe step that says 'do not frost until the layers are baked,' making sure you don't frost an empty pan.

Terraform Plan Flow
┌───────────────┐
│ Resource A    │
└──────┬────────┘
       │ depends_on
       ▼
┌───────────────┐
│ Resource B    │
└───────────────┘

Resource B waits for Resource A to finish before starting.

Build-Up - 7 Steps

1

Foundation

Terraform resource dependencies basics

Concept: Terraform automatically detects dependencies when one resource uses another's output.

When you write a resource that uses another resource's attribute, Terraform knows to create the first resource before the second. For example, if a server uses a network's ID, Terraform creates the network first.

Result

Terraform builds a dependency graph and creates resources in the correct order without extra instructions.

Understanding automatic dependencies helps you see when depends_on is needed and when it is not.

2

Foundation

When Terraform misses dependencies

Concept: Terraform cannot detect dependencies if resources don't reference each other directly.

If two resources are related but don't share attributes, Terraform might try to create them in parallel. For example, a firewall rule might depend on a server being ready, but if the rule doesn't use the server's attributes, Terraform won't know the order.

Result

Terraform may create resources in the wrong order, causing errors or failures.

Knowing Terraform's limits in detecting dependencies shows why explicit control is sometimes necessary.

3

Intermediate

Using depends_on to enforce order

🤔Before reading on: do you think depends_on changes resource content or just order? Commit to your answer.

Concept: depends_on tells Terraform to wait for specified resources to finish before acting on the current one.

You add depends_on inside a resource block listing other resources. Terraform then waits for those resources to complete before creating or updating this resource. It does not change the resource itself, only the order.

Result

Terraform creates resources in the order you specify, avoiding race conditions or errors.

Understanding that depends_on controls only execution order prevents confusion about resource data or attributes.

4

Intermediate

depends_on syntax and usage rules

🤔Before reading on: can depends_on accept multiple resources or only one? Commit to your answer.

Concept: depends_on accepts a list of resources to wait for, allowing complex dependency chains.

Inside a resource, you write depends_on = [resource1, resource2]. Terraform waits for all listed resources. depends_on can be used with any resource type, including modules and data sources.

Result

You can create precise dependency graphs even for complex infrastructure.

Knowing depends_on accepts multiple dependencies lets you model real-world resource relationships accurately.

5

Intermediate

Common use cases for depends_on

Concept: depends_on is often used when resources have side effects or implicit dependencies not visible in attributes.

Examples include waiting for DNS records to propagate, ensuring IAM roles exist before policies attach, or waiting for external systems. depends_on helps avoid timing issues in these cases.

Result

Infrastructure applies reliably without manual delays or retries.

Recognizing when implicit dependencies exist helps you apply depends_on effectively.

6

Advanced

depends_on with modules and data sources

🤔Before reading on: do you think depends_on works the same for modules as for resources? Commit to your answer.

Concept: depends_on can be used to control order between modules and data sources, not just resources.

You can add depends_on in module blocks to wait for other resources or modules. Similarly, data sources can have depends_on to wait for resources to be ready before querying.

Result

Complex multi-module setups apply in the correct order, avoiding errors.

Understanding depends_on's scope beyond resources unlocks advanced orchestration.

7

Expert

Hidden pitfalls and best practices with depends_on

🤔Before reading on: does overusing depends_on improve reliability or risk complexity? Commit to your answer.

Concept: Overusing depends_on can create unnecessary serialization, slowing down Terraform and hiding real dependency issues.

Depends_on should be used only when necessary. Overuse can cause Terraform to apply resources one by one, losing parallelism benefits. Also, depends_on does not fix configuration errors or missing references.

Result

Balanced use of depends_on leads to reliable and efficient infrastructure deployment.

Knowing when not to use depends_on prevents performance degradation and encourages better design.

Under the Hood

Terraform builds a dependency graph by analyzing resource references. When depends_on is present, Terraform adds explicit edges in this graph, forcing certain resources to wait for others. During the apply phase, Terraform follows this graph to decide the order of creation, update, or deletion. This ensures resources with depends_on dependencies are processed only after their dependencies complete successfully.

Why designed this way?

Terraform's automatic dependency detection works well for direct references but cannot see implicit or external dependencies. depends_on was introduced to give users control over these hidden relationships. This design balances automation with manual control, avoiding guesswork and errors in complex infrastructure setups.

Dependency Graph Example
┌───────────────┐      depends_on      ┌───────────────┐
│ Resource A    │─────────────────────▶│ Resource B    │
└───────────────┘                      └───────────────┘

Terraform creates Resource A first, then Resource B.

Myth Busters - 4 Common Misconceptions

Quick: Does depends_on change resource content or only order? Commit to your answer.

Common Belief: Depends_on changes the resource's configuration or data.

Reality: Depends_on only affects the order Terraform creates or updates resources; it does not modify resource content.

Why it matters: Thinking depends_on changes resource data can lead to confusion and misuse, causing incorrect assumptions about what Terraform does.

Quick: Can Terraform always detect all dependencies automatically? Commit to yes or no.

Common Belief: Terraform automatically detects all dependencies without manual hints.

Reality: Terraform detects dependencies only when resources reference each other directly; implicit or external dependencies require depends_on.

Why it matters: Assuming automatic detection is perfect can cause deployment failures due to missing dependency order.

Quick: Does adding many depends_on improve Terraform speed? Commit to yes or no.

Common Belief: More depends_on statements make Terraform run faster and safer.

Reality: Excessive depends_on serializes resource creation, slowing down Terraform and reducing parallelism.

Why it matters: Overusing depends_on can unnecessarily increase deployment time and complexity.

Quick: Can depends_on fix configuration errors like missing references? Commit to yes or no.

Common Belief: Depends_on can fix errors caused by missing resource references.

Reality: Depends_on only controls order; it does not fix configuration errors or missing data.

Why it matters: Relying on depends_on to fix errors can delay troubleshooting and cause unexpected failures.

Expert Zone

1

depends_on can be used with null_resource and local-exec provisioners to orchestrate complex workflows beyond simple resource creation.

2

Terraform 1.3 introduced depends_on support in modules and data sources, expanding its orchestration capabilities significantly.

3

Using depends_on with count or for_each requires careful referencing to avoid unexpected behavior or errors.

When NOT to use

Avoid depends_on when resources have direct attribute references that already create dependencies. Instead, fix missing references or redesign resource relationships. For complex orchestration, consider using Terraform modules or external orchestration tools like CI/CD pipelines.

Production Patterns

In production, depends_on is used to ensure IAM roles exist before policies attach, databases are ready before application servers start, and DNS records propagate before load balancers route traffic. It is also used to coordinate multi-cloud or multi-region deployments where timing matters.

Connections

Makefile dependency management

Both manage explicit dependencies to control execution order.

Understanding Makefile's explicit dependency rules helps grasp why Terraform needs depends_on to order resource creation.

Project management task dependencies

Depends_on is like defining task order in project plans to avoid starting tasks too early.

Knowing how project tasks depend on each other clarifies why infrastructure resources must be created in sequence.

Database transaction locking

Both ensure operations happen in a safe order to prevent conflicts or errors.

Recognizing that depends_on prevents race conditions in infrastructure is similar to how locks prevent data corruption in databases.

Common Pitfalls

#1 Using depends_on to fix missing attribute references.

Wrong approach:

resource "aws_instance" "example" {
depends_on = [aws_security_group.sg]
# No reference to aws_security_group.sg in attributes
}

Correct approach:

resource "aws_instance" "example" {
vpc_security_group_ids = [aws_security_group.sg.id]
# No depends_on needed because reference creates dependency
}

Root cause:

Misunderstanding that depends_on controls order but does not create attribute references.

#2 Overusing depends_on on every resource.

Wrong approach:

resource "aws_instance" "a" {
depends_on = [aws_security_group.sg, aws_subnet.subnet]
}
resource "aws_instance" "b" {
depends_on = [aws_instance.a]
}
# All resources depend on each other unnecessarily

Correct approach:

Only add depends_on where implicit dependencies are missing, keeping parallelism:
resource "aws_instance" "a" {
vpc_security_group_ids = [aws_security_group.sg.id]
}
resource "aws_instance" "b" {
depends_on = [aws_instance.a]
}

Root cause:

Believing more depends_on always improves reliability, ignoring performance impact.

#3 Using depends_on with incorrect resource references.

Wrong approach:

resource "aws_instance" "example" {
depends_on = [aws_security_group.nonexistent]
}

Correct approach:

resource "aws_instance" "example" {
depends_on = [aws_security_group.sg]
}

Root cause:

Typo or misunderstanding resource names causes Terraform errors.

Key Takeaways

Terraform automatically detects dependencies when resources reference each other, but depends_on lets you specify hidden or complex dependencies explicitly.

Depends_on controls the order of resource creation or update without changing resource content or data.

Overusing depends_on can slow down Terraform by forcing sequential execution, so use it only when necessary.

Depends_on works with resources, modules, and data sources, enabling complex orchestration in infrastructure deployments.

Understanding depends_on helps prevent deployment errors caused by incorrect resource creation order and improves infrastructure reliability.