Ignore_changes lifecycle rule in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Effect of ignore_changes on resource updates

Consider a Terraform resource with the ignore_changes lifecycle rule applied to the tags attribute. What happens when you manually update the tags of this resource outside Terraform and then run terraform apply?

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  tags = {
    Environment = "dev"
  }

  lifecycle {
    ignore_changes = ["tags"]
  }
}

A Terraform will throw an error during apply because tags were changed outside Terraform.

B Terraform will detect the manual tag changes and overwrite them with the tags defined in the configuration.

C Terraform will ignore manual changes to tags and keep them as they are without overwriting.

D Terraform will remove the tags attribute completely from the resource.

💡 Hint

Think about what ignore_changes means for attributes changed outside Terraform.

The ignore_changes lifecycle rule tells Terraform to ignore changes to specified attributes made outside Terraform. So manual changes to tags will not be overwritten during terraform apply.

❓ Configuration

intermediate

Correct syntax for ignore_changes lifecycle rule

Which of the following Terraform resource lifecycle blocks correctly uses ignore_changes to ignore changes to the metadata and labels attributes?

A

lifecycle {
  ignore_changes = [metadata, labels]
}

B

lifecycle {
  ignore_changes = ("metadata", "labels")
}

C

lifecycle {
  ignore_changes = { metadata, labels }
}

D

lifecycle {
  ignore_changes = ["metadata", "labels"]
}

💡 Hint

Remember how lists of strings are written in Terraform HCL.

The ignore_changes attribute expects a list of strings, so the attribute names must be quoted and enclosed in square brackets.

❓ Architecture

advanced

Using ignore_changes in multi-environment Terraform setup

You manage multiple environments (dev, staging, prod) with Terraform. You want to allow manual changes to the description attribute of a resource in the dev environment only, without Terraform overwriting it on apply. How should you configure ignore_changes to achieve this?

Terraform

variable "environment" {
  type = string
}

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket-${var.environment}"
  description = "Managed by Terraform"

  lifecycle {
    ignore_changes = var.environment == "dev" ? ["description"] : []
  }
}

A Use a conditional expression in <code>ignore_changes</code> to ignore <code>description</code> only when environment is dev.

B Set <code>ignore_changes</code> to always ignore <code>description</code> for all environments.

C Remove <code>ignore_changes</code> and manually revert changes after apply.

D Use separate Terraform workspaces without <code>ignore_changes</code>.

💡 Hint

Think about how to conditionally apply lifecycle rules based on variables.

Using a conditional expression in ignore_changes allows ignoring changes only in the dev environment, while other environments remain fully managed by Terraform.

❓ security

advanced

Security risks of using ignore_changes on sensitive attributes

What is a potential security risk when using ignore_changes on sensitive attributes like password or access_key in Terraform resources?

A Terraform will overwrite sensitive attributes with empty values, causing service disruption.

B Manual changes to sensitive attributes outside Terraform will persist unnoticed, possibly causing security drift.

C Terraform will expose sensitive attributes in logs when using ignore_changes.

D ignore_changes disables encryption on sensitive attributes.

💡 Hint

Consider what happens if Terraform ignores changes to secrets made outside its control.

Using ignore_changes on sensitive attributes means manual changes outside Terraform are not detected or reverted, which can lead to security drift and unmanaged secrets.

✅ Best Practice

expert

Best practice for using ignore_changes with nested attributes

You have a resource with a nested attribute settings.network. You want Terraform to ignore changes only to the network nested block but still manage other parts of settings. Which ignore_changes configuration is correct?

Terraform

resource "example_resource" "test" {
  settings = {
    network = {
      cidr_block = "10.0.0.0/16"
      dns = "8.8.8.8"
    }
    logging = true
  }

  lifecycle {
    ignore_changes = ["settings.network"]
  }
}

A ignore_changes = ["settings.network"]

B ignore_changes = ["settings"]

C ignore_changes = ["settings.network.cidr_block", "settings.network.dns"]

D ignore_changes = ["settings.network.*"]

💡 Hint

Think about how Terraform references nested blocks in ignore_changes.

Using "settings.network" tells Terraform to ignore changes to the entire nested network block but still manage other parts of settings. Ignoring settings would ignore all nested attributes.