New Feature: "Objects have changed outside of Terraform"

Introduction

Starting with Terraform v0.15.4, the terraform plan command provides explicit reporting when it detects that remote infrastructure objects have changed since the last time Terraform managed them. Previously, Terraform would silently update its state file to match these changes during the refresh phase. This feature makes the process visible to you.

Reviewing these changes is important for understanding how Terraform's state is being modified to align with the remote system. This visibility helps you identify both expected and unexpected modifications to your infrastructure, preventing potential configuration issues.

Feature Behavior by Version

The reporting behavior for this feature has evolved in different versions of Terraform.

Terraform v1.2.0 and Newer

To reduce excessive output for large configurations, which could cause workflow interruptions, the reporting was refined. For more details, refer to GitHub Issue 28803.

In these newer versions, the note Objects have changed outside of Terraform only appears in the plan output if the detected remote changes are directly related to resources or attributes that Terraform proposes to modify in the current run. This change is detailed in GitHub Issue 30486.

Terraform v0.15.4 to v1.1.x

In these versions, Terraform streamed all detected changes to the state file. Below are examples of the output you might see.

Example: In-Place Update

This example shows the output when Terraform detects an in-place change on a remote object and updates the state file to match.

Reporting this change is critical because it can affect the behavior of your configuration. For instance, if another expression in your module references aws_batch_compute_environment.test.compute_resources[0].desired_vcpus, its value would change from 0 to 2 after this update. This reporting provides context for the actions Terraform plans to take.

Example: Adding Remote Objects to State

Terraform may also report the addition of provider-required objects that exist remotely but are not yet tracked in the state file.

Important Considerations

Disabling Refresh Behavior

Caution: The only mechanism to disable remote change detection during a refresh is the global -refresh=false option. Using this option prevents Terraform from refreshing any resources.

HashiCorp recommends allowing Terraform to refresh during the planning phase (default behavior) to ensure the plan is based on the most current state of your remote objects.

Understanding ignore_changes

The ignore_changes lifecycle argument does not prevent Terraform from reporting on remote object changes. This argument instructs Terraform to ignore differences between the configuration and the state. The "Objects have changed outside of Terraform" message reports differences between the prior state and the remote objects themselves.