Problem
During the Terraform plan phase, the system may show inaccurate changes that suggest updates will be made. However, when the apply phase is executed, no actual changes occur to the infrastructure.
Prerequisites
- The Terraform code should include a data block that has a depends_on relationship with the resource.
- Inaccurate changes occur when there are modifications made to that resource.
Cause
This issue often arises when data sources are unintentionally made to depend on other resources. When the resource is changed, the data block is read during the apply phase. This leads to updates in resources that depend on that data resource, even if the resource itself has not changed. As a result, fewer resources are updated during the apply phase than initially indicated in the plan.
example:
Terraform will perform the following actions:
# data.tfcoremock_simple_resource.test2 will be read during apply
# (depends on a resource or a module with changes pending)
<= data "tfcoremock_simple_resource" "test2" {
+ bool = (known after apply)
+ float = (known after apply)
+ id = "example_data"
+ integer = (known after apply)
+ number = (known after apply)
+ string = (known after apply)
}
# tfcoremock_simple_resource.test1 will be updated in-place
~ resource "tfcoremock_simple_resource" "test1" {
id = "93460adf-6019-3646-7968-403e0421ee10"
~ string = "test1" -> "test-x"
}
# tfcoremock_simple_resource.test2 will be updated in-place
~ resource "tfcoremock_simple_resource" "test2" {
id = "ca4c93ee-67cd-67d7-d4ed-14935ac1f214"
~ string = "some data example" -> (known after apply)
}
Plan: 0 to add, 2 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
tfcoremock_simple_resource.test1: Modifying... [id=93460adf-6019-3646-7968-403e0421ee10]
tfcoremock_simple_resource.test1: Modifications complete after 0s [id=93460adf-6019-3646-7968-403e0421ee10]
data.tfcoremock_simple_resource.test2: Reading...
data.tfcoremock_simple_resource.test2: Read complete after 0s
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
Solutions
- Users should review their configuration to avoid using depends_on.
- A possible solution is to remove the depends_on from the module and create necessary dependencies by generating outputs from the module that needs to be created first. These outputs can then be passed to the modules that need to be created subsequently. This approach will significantly narrow the scope of dependencies, making the plans more predictable.
Outcome
By carefully reviewing and restructuring the Terraform configuration to eliminate unnecessary depends_on statements and effectively manage dependencies through module outputs, users can significantly improve the accuracy of Terraform plans. This will result in more predictable infrastructure changes and reduce the likelihood of unintended modifications during the apply process.