Workarounds
A lifecycle block cannot take a variable, and that single Terraform and
OpenTofu restriction is behind most recurring "why can't this module just…"
requests: prevent_destroy on a data bucket, ignore_changes on tags an
external controller writes, create_before_destroy on a security group that is
still attached. These pages are for engineers who hit one of them in a
terraform-aws-modules module. Each states the cause, links the upstream issues,
gives the native workaround in full, and names the Operational Rule that answers
it, or says there is none yet.
Modules
Each problem links the Playground with only its rule selected; the last column opens the module with every rule this page answers.
| Module | Problems and the rule that answers each | Playground |
|---|---|---|
| Auto Scaling | Auto Scaling group desired_capacity reverts on every apply - lifecycle_ignore_scaling_changes | Open with all rules |
| DynamoDB table | DynamoDB read and write capacity reverts on every plan - lifecycle_ignore_autoscaling_changes terraform destroy deleted a DynamoDB table - lifecycle_prevent_destroy_data | Open with all rules |
| EC2 instance | Terraform wants to replace my EC2 instance because the AMI changed - lifecycle_ignore_ami_changes | Open with all rules |
| ECS | Terraform reverts the task definition my pipeline just deployed - lifecycle_ignore_deployed_artifacts | Open with all rules |
| EKS | Changing desired_size on an EKS node group does nothing, and raising min_size fails - eks_node_group_set_desired_size | Open with all rules |
| IAM | Terraform keeps reverting tags on IAM roles - lifecycle_ignore_tags | Open with all rules |
| KMS | terraform destroy scheduled deletion of a KMS key - lifecycle_prevent_destroy_encryption | Open with all rules |
| Lambda | Terraform keeps reverting my Lambda code to an old version - lifecycle_ignore_deployed_artifacts | Open with all rules |
| RDS | terraform destroy deleted a production database - lifecycle_prevent_destroy_data Terraform wants to reset the database password on every plan - lifecycle_ignore_secret_rotation | Open with all rules |
| RDS Aurora | terraform destroy deleted an Aurora cluster - lifecycle_prevent_destroy_data | Open with all rules |
| S3 bucket | terraform destroy deleted a production S3 bucket - lifecycle_prevent_destroy_data Terraform keeps reverting tags on my S3 buckets - lifecycle_ignore_tags | Open with all rules |
| Secrets Manager | terraform destroy deleted a secret other systems depend on - lifecycle_prevent_destroy_encryption | Open with all rules |
| VPC | Terraform keeps removing the tags that Kubernetes and load balancer controllers add - lifecycle_ignore_tags | Open with all rules |
How to read a page
- The symptom, written the way it gets searched for.
- Why Terraform cannot fix it, with the upstream issues so you can check.
- The native workaround in full, including when it is a fork.
- The rule, where one exists, with the HCL diff it produces - or an explicit "native option only, today" where it does not.
On a framework host you name the rules you want in ?add_rules=, on top of
whatever Baseline your organization has Enforced; on an organization host that
organization's configuration decides.
Related
- Rules overview - what rules are, and how they differ from compliance controls
- Rule definitions - the HCL of every selectable rule
- Preview a rule - the API behind the Rules Playground