Demo Manage Resource Behavior with lifecycle

This lesson demonstrates Terraform’s lifecycle meta-argument — specifically ignore_changes — and how it lets you allow out-of-band updates (for example, manual tag edits in the AWS Console) without Terraform attempting to revert them. You’ll learn the minimal Terraform configuration used for the demo, how Terraform detects drift, and how adding ignore_changes changes Terraform’s behavior.

This demo uses AWS S3 resources. You should have the AWS provider configured and credentials available (for example via AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY or an AWS profile). See the Terraform docs for provider setup: https://developer.hashicorp.com/terraform/providers/aws

Resources in main.tf

The example main.tf below creates an S3 bucket plus ownership controls and an ACL. This is intentionally minimal so you can focus on lifecycle behavior.

resource "aws_s3_bucket" "bryan" {
  bucket = "bryans-example-bucket-for-terraform"

  tags = {
    Environment = "production"
    CreatedBy   = "terraform"
  }
}

resource "aws_s3_bucket_ownership_controls" "example" {
  bucket = aws_s3_bucket.bryan.id

  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_acl" "example" {
  bucket = aws_s3_bucket.bryan.id
  acl    = "private"

  depends_on = [ aws_s3_bucket_ownership_controls.example ]
}

Apply the configuration to create the bucket and supporting resources:

terraform apply

When prompted, respond yes. The apply will create the resources and produce output similar to:

aws_s3_bucket.bryan: Creating...
aws_s3_bucket.bryan: Creation complete after 1s [id=bryans-example-bucket-for-terraform]
aws_s3_bucket_ownership_controls.example: Creating...
aws_s3_bucket_ownership_controls.example: Creation complete after 1s [id=bryans-example-bucket-for-terraform]
aws_s3_bucket_acl.example: Creating...
aws_s3_bucket_acl.example: Creation complete after 0s [id=bryans-example-bucket-for-terraform,private]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

You can confirm the bucket exists in the AWS Console:

A screenshot of the AWS S3 Buckets console showing the "General purpose buckets" view with a search for "bryans" and one result: "bryans-example-bucket-for-terraform" in the US East (N. Virginia) region.

Scenario: Out-of-band tag change

If you open the bucket in the AWS Console under Properties, you’ll see the tags created by Terraform:

Environment = production
CreatedBy = terraform

Now imagine a user manually edits the bucket tags in the AWS Console and changes Environment from production to testing. This is an out-of-band change (i.e., not made through Terraform). To see how Terraform reacts, run a refresh/plan:

terraform plan

Terraform refreshes state and detects differences. Example plan output showing a tag difference:

aws_s3_bucket.bryan: Refreshing state... [id=bryans-example-bucket-for-terraform]

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_s3_bucket.bryan will be updated in-place
  ~ resource "aws_s3_bucket" "bryan" {
      ...
      ~ tags = {
          "CreatedBy"  = "terraform"
        ~ "Environment" = "testing" -> "production"
      }
      ...
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Because the configuration still sets Environment = production, Terraform plans to revert the manual change back to production.

Allowing out-of-band edits with lifecycle.ignore_changes

If you want to permit manual updates to specific attributes (for example, user-modified tags in the console) and prevent Terraform from reverting them, add a lifecycle block with ignore_changes to the resource. Update the aws_s3_bucket resource like this:

resource "aws_s3_bucket" "bryan" {
  bucket = "bryans-example-bucket-for-terraform"

  tags = {
    Environment = "production"
    CreatedBy   = "terraform"
  }

  lifecycle {
    ignore_changes = [tags]
  }
}

This instructs Terraform to ignore differences to the tags attribute when refreshing state and planning changes. Run terraform plan again:

terraform plan

After the refresh, Terraform reports no changes required:

aws_s3_bucket.bryan: Refreshing state... [id=bryans-example-bucket-for-terraform]
aws_s3_bucket_ownership_controls.example: Refreshing state... [id=bryans-example-bucket-for-terraform]
aws_s3_bucket_acl.example: Refreshing state... [id=bryans-example-bucket-for-terraform,private]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Even though the AWS Console may still display Environment: testing, Terraform will not attempt to revert it because ignore_changes tells Terraform to stop reconciling the tags attribute:

A screenshot of an AWS S3 bucket settings page showing "Bucket Versioning" as disabled, tags (Environment: testing, CreatedBy: terraform), and default encryption details. It’s the AWS Management Console view for a specific S3 bucket.

Use ignore_changes sparingly. Ignoring changes causes Terraform to stop reconciling that attribute, which can lead to drift between your configuration and real infrastructure. Prefer allowing Terraform to manage attributes unless you have a clear operational need for out-of-band edits.

When to use `ignore_changes`

Use case	Recommendation
Letting users edit UI-managed metadata (e.g., tags) without Terraform reverting it	Consider `ignore_changes = [tags]`, but document the reason and scope.
Temporarily avoiding updates while debugging or migrating	Use `ignore_changes` as a short-term measure, remove it when resolved.
Permanently delegating lifecycle of an attribute to another tool	Use with caution and ensure lifecycle is well-documented.

Summary

By default, Terraform detects drift between configuration and real infrastructure and will plan to reconcile differences.
The lifecycle meta-argument with ignore_changes allows you to instruct Terraform to ignore specific attribute changes (for example, tags) so out-of-band updates are not reverted.
Use ignore_changes intentionally, document why certain attributes are ignored, and minimize its scope to avoid unexpected drift.

Course Introduction

Preparing Your Environment

Terraform Foundations

The Core Terraform Workflow

Terraform CLI

Terraform File Structure and Organization

Terraform Configuration - Fundamentals

Understading and Managing Terraform State

Marking Code Reusable

Refactoring Terraform State

Terraform Modules

Managing Resource Behavior and Dependencies

Securing Terraform Configurations

Terraform Troubleshooting

HCP Terraform

Demo Manage Resource Behavior with lifecycle

Resources in main.tf

Scenario: Out-of-band tag change

Allowing out-of-band edits with lifecycle.ignore_changes

When to use `ignore_changes`

Summary

Watch Video

Practice Lab

​Resources in main.tf

​Scenario: Out-of-band tag change

​Allowing out-of-band edits with lifecycle.ignore_changes

​When to use ignore_changes

​Summary

Watch Video

Practice Lab

Resources in main.tf

Scenario: Out-of-band tag change

Allowing out-of-band edits with lifecycle.ignore_changes

When to use `ignore_changes`

Summary