Lifecycle customization in Terraform - Commands & Configuration

Introduction

Sometimes you want to control how Terraform creates, updates, or deletes resources. Lifecycle customization lets you tell Terraform to ignore changes, prevent deletion, or create resources before others. This helps avoid accidental data loss or downtime.

When you want Terraform to keep a resource even if you remove it from your code to avoid accidental deletion.

When you want Terraform to ignore changes to certain resource attributes that are managed outside Terraform.

When you need Terraform to create a resource before another one to avoid dependency issues.

When you want to prevent Terraform from replacing a resource during updates.

When you want to control the order of resource creation and deletion explicitly.

Config File - main.tf

main.tf

resource "aws_s3_bucket" "example" {
  bucket = "my-example-bucket-terraform"

  lifecycle {
    prevent_destroy = true
    ignore_changes  = ["tags"]
    create_before_destroy = true
  }
}

The resource block defines an AWS S3 bucket named example.

The lifecycle block customizes how Terraform manages this resource:

• prevent_destroy: stops Terraform from deleting the bucket, protecting data.
• ignore_changes: tells Terraform to ignore changes to the tags attribute, useful if tags are changed outside Terraform.
• create_before_destroy: ensures Terraform creates a new bucket before deleting the old one during updates, avoiding downtime.

Commands

Initializes the Terraform working directory and downloads necessary provider plugins.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/aws...

- Installing hashicorp/aws v4.0.0...

- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure.

Shows the changes Terraform will make to match the configuration, respecting lifecycle rules.

Terminal

terraform plan

Expected Output

An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # aws_s3_bucket.example will be created

  + resource "aws_s3_bucket" "example" {

      + bucket = "my-example-bucket-terraform"

      + id     = (known after apply)

    }



Plan: 1 to add, 0 to change, 0 to destroy.

Applies the planned changes to create the S3 bucket with lifecycle customizations.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example: Creating...

aws_s3_bucket.example: Creation complete after 2s [id=my-example-bucket-terraform]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approves the apply without prompting for confirmation.

Attempts to destroy the resources, but lifecycle prevent_destroy will block deletion.

Terminal

terraform destroy -auto-approve

Expected Output

Error: Instance cannot be destroyed



  on main.tf line 1, in resource "aws_s3_bucket" "example":

   1: resource "aws_s3_bucket" "example" {



Resource aws_s3_bucket.example has lifecycle.prevent_destroy set, so it cannot be destroyed.

→

-auto-approve - Automatically approves the destroy without prompting for confirmation.

Key Concept

If you remember nothing else from this pattern, remember: lifecycle blocks let you control how Terraform creates, updates, or deletes resources to protect your infrastructure.

Common Mistakes

Removing a resource from the configuration expecting Terraform to delete it, but prevent_destroy is set.

Terraform will refuse to delete the resource, causing apply or destroy to fail.

Remove or set prevent_destroy to false before deleting the resource from the configuration.

Expecting ignore_changes to prevent all updates to a resource.

ignore_changes only ignores specified attributes; other changes will still be applied.

Specify all attributes you want Terraform to ignore inside ignore_changes.

Not using create_before_destroy when updating resources that require replacement, causing downtime.

Terraform destroys the old resource before creating the new one, causing service interruption.

Set create_before_destroy = true in the lifecycle block to create new resources first.

Summary

Use the lifecycle block inside resource definitions to customize resource management.

prevent_destroy protects resources from accidental deletion by Terraform.

ignore_changes lets Terraform ignore changes to specific resource attributes.

create_before_destroy ensures new resources are created before old ones are destroyed to avoid downtime.

Practice

1. What does the create_before_destroy lifecycle setting do in Terraform?

easy

A. It ignores changes to specific resource attributes during updates.

B. It prevents the resource from being destroyed under any circumstances.

C. It forces Terraform to destroy the resource before creating a new one.

D. It creates a new resource before destroying the old one to avoid downtime.

Solution

1. Step 1: Understand the purpose of create_before_destroy

   This setting ensures Terraform creates the replacement resource first.

2. Step 2: Avoid downtime during resource replacement

   By creating the new resource before destroying the old, service interruptions are minimized.

3. Final Answer:

   It creates a new resource before destroying the old one to avoid downtime. -> Option D

4. Quick Check:

   create_before_destroy = create new before delete [OK]

Hint: Remember: create_before_destroy means new first, then old removed [OK]

Common Mistakes:

• Confusing create_before_destroy with prevent_destroy
• Thinking it deletes first then creates
• Assuming it ignores changes

2. Which of the following is the correct syntax to prevent a resource from being destroyed in Terraform?

easy

A. lifecycle { ignore_changes = true }

B. lifecycle { prevent_destroy = true }

C. lifecycle { create_before_destroy = true }

D. lifecycle { destroy_protection = true }

Solution

1. Step 1: Identify the correct lifecycle argument to prevent destruction

   The argument is prevent_destroy set to true.

2. Step 2: Verify syntax correctness

   The syntax is lifecycle { prevent_destroy = true }, which is valid Terraform code.

3. Final Answer:

   lifecycle { prevent_destroy = true } -> Option B

4. Quick Check:

   prevent_destroy = true prevents deletion [OK]

Hint: Use prevent_destroy = true to block resource deletion [OK]

Common Mistakes:

• Using ignore_changes instead of prevent_destroy
• Using a non-existent destroy_protection argument
• Confusing create_before_destroy with prevent_destroy

3. Given this Terraform resource snippet:

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  lifecycle {
    ignore_changes = ["tags"]
  }
}

What happens if you manually change the tags of this instance outside Terraform and then run terraform apply?

medium

A. Terraform will ignore the tag changes and keep the manual tags as is.

B. Terraform will destroy and recreate the instance to sync tags.

C. Terraform will throw an error due to tag mismatch.

D. Terraform will overwrite the manual tag changes with the configuration tags.

Solution

1. Step 1: Understand the effect of ignore_changes on tags

   The lifecycle setting ignore_changes = ["tags"] tells Terraform to ignore any changes to tags made outside Terraform.

2. Step 2: Predict Terraform behavior on apply

   Terraform will not attempt to update tags, so manual changes remain intact without error or replacement.

3. Final Answer:

   Terraform will ignore the tag changes and keep the manual tags as is. -> Option A

4. Quick Check:

   ignore_changes on tags means manual tag changes stay [OK]

Hint: ignore_changes = ["tags"] means Terraform skips tag updates [OK]

Common Mistakes:

• Assuming Terraform overwrites manual tag changes
• Expecting an error on tag mismatch
• Thinking resource will be recreated

4. You have this Terraform lifecycle block:

lifecycle {
  create_before_destroy = true
  prevent_destroy = true
}

What problem will occur if you try to update this resource that requires replacement?

medium

A. Terraform will create the new resource and destroy the old one successfully.

B. Terraform will ignore prevent_destroy and destroy the resource anyway.

C. Terraform will fail because it cannot destroy the old resource due to prevent_destroy.

D. Terraform will skip the update and keep the old resource unchanged.

Solution

1. Step 1: Analyze interaction of create_before_destroy and prevent_destroy

   create_before_destroy tries to create new resource before deleting old one, but prevent_destroy forbids deletion.

2. Step 2: Understand Terraform behavior on replacement

   Terraform cannot destroy the old resource due to prevent_destroy, so replacement fails.

3. Final Answer:

   Terraform will fail because it cannot destroy the old resource due to prevent_destroy. -> Option C

4. Quick Check:

   prevent_destroy blocks deletion, causing failure with create_before_destroy [OK]

Hint: prevent_destroy blocks deletion, so replacement fails [OK]

Common Mistakes:

• Assuming Terraform ignores prevent_destroy
• Thinking resource updates without replacement
• Believing create_before_destroy overrides prevent_destroy

5. You want to update an AWS S3 bucket's tags without triggering bucket replacement or downtime. Which lifecycle customization should you apply in Terraform to achieve this?

hard

A. Use ignore_changes = ["tags"] to skip tag updates.

B. Use prevent_destroy = true to block bucket deletion.

C. Use create_before_destroy = true to create new bucket first.

D. Use ignore_changes = ["versioning"] to skip versioning changes.

Solution

1. Step 1: Identify the goal to update tags without replacement

   Tags often cause resource updates; ignoring changes to tags avoids replacement.

2. Step 2: Choose lifecycle setting to ignore tag changes

   Setting ignore_changes = ["tags"] tells Terraform not to replace the bucket when tags change.

3. Final Answer:

   Use ignore_changes = ["tags"] to skip tag updates. -> Option A

4. Quick Check:

   ignore_changes on tags prevents replacement on tag updates [OK]

Hint: Ignore tag changes to update tags without replacement [OK]

Common Mistakes:

• Using prevent_destroy which blocks deletion but not replacement
• Using create_before_destroy which affects replacement order
• Ignoring unrelated attributes like versioning