> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# LifeCycle Rules
> This article explains OpenTofu's lifecycle rules for managing resource creation, updates, and destruction to prevent downtime and accidental changes.
In this lesson, we’ll dive into OpenTofu’s lifecycle rules to control how resources are created, updated, or destroyed. Proper use of these rules helps you avoid downtime, accidental deletions, and unnecessary modifications.
## Table of Contents
* [Default Behavior](#default-behavior)
* [create\_before\_destroy](#1-create_before_destroy)
* [prevent\_destroy](#2-prevent_destroy)
* [ignore\_changes](#3-ignore_changes)
* [Summary of Lifecycle Rules](#summary-of-lifecycle-rules)
* [Further Reading](#further-reading)
***
## Default Behavior
By default, OpenTofu will destroy and then recreate any resource if a change requires replacement (for example, updating an AMI in an `aws_instance`).
```hcl theme={null}
resource "aws_instance" "cerberus" {
ami = "ami-2158c0f087598787a"
instance_type = "m5.large"
tags = {
Name = "Cerberus-Webserver"
}
}
```
After changing the `ami` value and running `tofu apply`, you’ll see:
```bash theme={null}
$ tofu apply
...
Plan: 1 to add, 0 to change, 1 to destroy.
...
aws_instance.cerberus: Destroying... [id=i-0abcd1234efgh567a]
aws_instance.cerberus: Creation complete after 1m2s [id=i-1wxyz9876uvgh5432]
Apply complete! Resources: 1 added, 0 changed, 1 destroyed.
```
***
## 1. create\_before\_destroy
Use `create_before_destroy = true` to provision the replacement resource before tearing down the old one. This helps minimize downtime.
```hcl theme={null}
resource "aws_instance" "cerberus" {
ami = "ami-2158c0f087598787a"
instance_type = "m5.large"
tags = {
Name = "Cerberus-Webserver"
}
lifecycle {
create_before_destroy = true
}
}
```
Running `tofu apply` now provisions the new instance first:
```bash theme={null}
$ tofu apply
...
Plan: 1 to add, 0 to change, 1 to destroy.
...
aws_instance.cerberus: Creating...
aws_instance.cerberus: Creation complete after 1m1s [id=i-9abcd1234mnop678]
aws_instance.cerberus: Destroying... [id=i-0abcd1234efgh567a]
Apply complete! Resources: 1 added, 0 changed, 1 destroyed.
```
***
## 2. prevent\_destroy
Set `prevent_destroy = true` to block any accidental deletion during an `apply`. OpenTofu will throw an error if a change requires replacement.
```hcl theme={null}
resource "aws_instance" "cerberus" {
ami = "ami-2158c0f087598787a"
instance_type = "m5.large"
tags = {
Name = "Cerberus-Webserver"
}
lifecycle {
prevent_destroy = true
}
}
```
If you change the AMI and run `tofu apply`, you’ll get:
```bash theme={null}
$ tofu apply
Error: Instance aws_instance.cerberus must be replaced
on main.tf line 2, in resource "aws_instance" "cerberus":
2: resource "aws_instance" "cerberus" {
Resource aws_instance.cerberus has lifecycle prevent_destroy set, but plan requires resource to be replaced. This operation would destroy the existing resource.
```
`prevent_destroy` does *not* block a direct `tofu destroy`. It only prevents destruction during apply operations triggered by configuration changes.
***
## 3. ignore\_changes
The `ignore_changes` meta-argument instructs OpenTofu to skip tracking specified attributes, even if they drift from your configuration.
```hcl theme={null}
resource "aws_instance" "cerberus" {
ami = "ami-2158c0f087598787a"
instance_type = "m5.large"
tags = {
Name = "Cerberus-Webserver-1"
}
lifecycle {
ignore_changes = [
tags
]
}
}
```
If someone updates the `Name` tag manually in the AWS console, `tofu apply` reports no changes:
```bash theme={null}
$ tofu apply
aws_instance.cerberus: Refreshing state... [id=i-1234567890abcdef0]
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
```
You can ignore multiple attributes, or even all changes:
```hcl theme={null}
resource "aws_instance" "cerberus" {
ami = "ami-2158c0f087598787a"
instance_type = "m5.large"
tags = {
Name = "Cerberus-Webserver-2"
}
lifecycle {
ignore_changes = all
}
}
```
```bash theme={null}
$ tofu apply
aws_instance.cerberus: Refreshing state... [id=i-1234567890abcdef0]
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
```
Use `ignore_changes = all` cautiously. Ignoring all drift may mask unintended configuration drift over time.
***
## Summary of Lifecycle Rules
| Rule | Description | Example |
| ----------------------- | ------------------------------------------------------------------------------------------------ | ---------------------------------- |
| create\_before\_destroy | Provision the new resource before destroying the old to minimize downtime. | `create_before_destroy = true` |
| prevent\_destroy | Block any destructive change during `apply`, protecting critical resources. | `prevent_destroy = true` |
| ignore\_changes | Skip specific attribute changes or all drift between config and real-world state. | `ignore_changes = [tags]` or `all` |
| Default (no lifecycle) | Replace resources by destroying then recreating whenever a change requires resource replacement. | N/A |
***
## Further Reading
* [OpenTofu Documentation on Lifecycle Rules](https://github.com/opentofu/opentofu/blob/main/docs/lifecycle.md)
* [Terraform Meta-Arguments: Lifecycle](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle)