Lifecycle #

# SCENARIO: Updating the AMI on an instance serving production traffic

# ANTI-PATTERN: Default behavior — downtime during replace
resource "aws_instance" "web" {
  ami           = var.ami_id  # Changing the AMI → forces replacement
  instance_type = "t3.micro"
  # Default order:
  # 1. Destroy the old instance → traffic dies
  # 2. Create the new instance  → traffic comes back
  # Downtime: ~20-30 seconds
}

# CORRECT: create_before_destroy — zero downtime replace
resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = "t3.micro"

  lifecycle {
    create_before_destroy = true
    # New order:
    # 1. Create the new instance → running
    # 2. Destroy the old instance → no downtime
    # (make sure there's a mechanism to shift traffic first,
    # e.g. a load balancer attachment)
  }
}

# create_before_destroy is very useful for SSL certificates
resource "aws_acm_certificate" "main" {
  domain_name       = var.domain_name
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
    # A new certificate is created and validated before the old one is deleted
    # No period where the domain lacks a valid certificate
  }
}

# A production resource that must never be accidentally deleted
resource "aws_rds_instance" "production" {
  identifier        = "production-db"
  engine            = "postgres"
  engine_version    = "15.3"
  instance_class    = "db.t3.medium"
  allocated_storage = 100
  storage_encrypted = true

  lifecycle {
    prevent_destroy = true
  }
}

# What happens if someone tries terraform destroy:
# ╷
# │ Error: Instance cannot be destroyed
# │
# │   on main.tf line 1, in resource "aws_rds_instance" "production":
# │    1: resource "aws_rds_instance" "production" {
# │
# │ Resource aws_rds_instance.production has lifecycle.prevent_destroy
# │ set to true. To allow this object to be destroyed, remove or disable
# │ this attribute.
# ╵

resource "aws_autoscaling_group" "web" {
  name         = "web-asg"
  min_size     = 2
  max_size     = 10
  desired_capacity = 2

  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }

  lifecycle {
    ignore_changes = [
      # desired_capacity is managed by the auto scaling policy — ignore it
      desired_capacity,

      # the "LastDeployedAt" tag is updated by the deployment pipeline — ignore it
      tag,
    ]
  }
}

# ignore_changes = all — ignore ALL changes to the resource's attributes
# Use with great care — this means Terraform will never
# update this resource after it's created
resource "aws_instance" "immutable" {
  ami           = var.ami_id
  instance_type = "t3.micro"

  lifecycle {
    ignore_changes = all
    # Useful for "immutable" resources created only once
    # and never changed — configuration changes only apply
    # to new instances, not existing ones
  }
}

# SCENARIO: The instance must be replaced whenever the launch template changes
resource "aws_launch_template" "web" {
  name_prefix   = "web-"
  image_id      = var.ami_id
  instance_type = "t3.micro"
}

resource "aws_instance" "web" {
  # This instance doesn't directly depend on the launch template version,
  # but we want it replaced every time the launch template changes

  launch_template {
    id      = aws_launch_template.web.id
    version = aws_launch_template.web.latest_version
  }

  lifecycle {
    replace_triggered_by = [
      aws_launch_template.web  # Replace the instance if the launch template changes
    ]
  }
}

resource "aws_db_instance" "main" {
  identifier        = "app-database"
  engine            = "mysql"
  instance_class    = "db.t3.medium"
  allocated_storage = 50
  storage_encrypted = true

  # Password is rotated by secrets manager — don't overwrite it
  password = data.aws_secretsmanager_secret_version.db_password.secret_string

  lifecycle {
    # Create a new DB before deleting the old one during a replace
    create_before_destroy = true

    # Protect against accidental destroys
    prevent_destroy = true

    # Ignore password changes — managed by secrets manager
    ignore_changes = [password]
  }
}

# Database: prevent_destroy to prevent accidental deletion
resource "aws_db_instance" "main" {
  identifier     = "production-db"
  engine         = "postgres"
  instance_class = "db.t3.medium"
  
  lifecycle {
    prevent_destroy = true
    # a terraform apply that tries to destroy → ERROR
    # You must remove this lifecycle (with review) before you can destroy
  }
}

# Instance: create_before_destroy for zero downtime
resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = var.instance_type
  
  lifecycle {
    create_before_destroy = true
    # The new instance is created FIRST, then the old one is destroyed
    # Avoids downtime
  }
}

# Edge Case 1: prevent_destroy with import
# If you import a resource that already has prevent_destroy:
terraform import aws_db_instance.main i-12345
# The import succeeds, but future destroys will be blocked

# Edge Case 2: create_before_destroy with force-new
# If an attribute changes that forces a new resource:
# 1. Terraform creates the new instance
# 2. Waits for the new instance to "finish"
# 3. Deletes the old instance
# But: dependencies on the old instance can cause problems

# Edge Case 3: overly broad ignore_changes
lifecycle {
  ignore_changes = all  # IGNORE ALL CHANGES
  # Only use for resources Terraform's management is truly complete on
}

# BEST PRACTICE: When to use each lifecycle rule

# prevent_destroy: Resources that must never disappear
# - Production databases
# - S3 buckets with important data
# - KMS keys (encrypted data becomes inaccessible)
# - DNS zones
resource "aws_db_instance" "production" {
  lifecycle {
    prevent_destroy = true
  }
}

# create_before_destroy: Zero-downtime replacement
# - EC2 instances behind a load balancer
# - Lambda functions
# - CloudWatch alarms
resource "aws_instance" "web" {
  lifecycle {
    create_before_destroy = true
  }
}

# ignore_changes: Ignore specific changes
# - Auto-scaling group desired capacity
# - External monitoring that changes tags
resource "aws_autoscaling_group" "web" {
  desired_capacity = 2
  lifecycle {
    ignore_changes = [desired_capacity]
  }
}