lifecycle_create_before_destroy warning Stand up the replacement before destroying the old resource, so a security group still attached to an ENI or a certificate still bound to a listener can be replaced without a failed apply or an outage default scope aws_security_group aws_acm_certificate lifecycle_ignore_ami_changes warning Ignore AMI changes on EC2 instances to prevent unnecessary replacements default scope aws_instance aws_launch_template lifecycle_ignore_autoscaling_changes warning Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift default scope aws_dynamodb_table lifecycle_ignore_deployed_artifacts warning Ignore the artifact pointer a deployment pipeline rewrites on Lambda functions and ECS services, so the next Terraform run stops rolling the deployed version back. Assumes something other than Terraform deploys the code: do not enable it where Terraform builds the artifact (create_package = true) or builds the container image default scope aws_lambda_function aws_ecs_service lifecycle_ignore_scaling_changes warning Ignore the capacity attribute an external autoscaler owns on ASGs, EKS node groups and ECS services, so Terraform stops reverting the scaler default scope aws_autoscaling_group aws_eks_node_group aws_ecs_service lifecycle_ignore_secret_rotation warning Ignore the database credential attribute so a value that changes between plans - a regenerated random_password, a rotated secrets-manager or Vault data source, a variable supplied differently per runner - stops showing as a perpetual diff default scope aws_db_instance aws_rds_cluster lifecycle_ignore_tag_keys warning Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value default scope aws_s3_bucket lifecycle_ignore_tags warning Ignore tag changes in lifecycle to prevent Terraform drift on managed resources default scope aws_* provisioner_remove_blocks warning Remove provisioner blocks which are an anti-pattern in reusable modules s3_lifecycle_abort_incomplete_uploads warning Require an enabled S3 lifecycle rule that aborts incomplete multipart uploads, so parts that are billed but never listed stop accumulating fixed scope aws_s3_bucket_lifecycle_configuration source_sanitize_content warning Remove politically offensive content from Terraform modules