AWS provider Resource Lifecycle Management Practice Test 2 — 15 Questions

Question 1

You manage an Amazon RDS DB instance declared with the aws_db_instance resource. Your team's compliance policy requires that the production database can never be destroyed by a terraform apply, but developers still need to be able to run terraform destroy on ephemeral staging stacks from the same configuration. Which approach best satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set lifecycle { prevent_destroy = true } on the aws_db_instance resource and define the value through a variable that is true only when var.environment == "prod".. The requirement is a conditional safety rail: destruction must be blocked in production yet allowed in staging from the same code. prevent_destroy accepts an expression, so wiring it to an environment variable enforces the rule at plan time for prod while leaving staging destroyable. Ordering meta-arguments and operational conventions cannot prevent an explicit destroy.

Answer

Add lifecycle { create_before_destroy = true } to the aws_db_instance so the database is never left in a destroyed state during updates.

Answer

Apply a separate terraform destroy -target=aws_db_instance.staging command and rely on operators never targeting the production instance.

Answer

Move the production database into a separate workspace and document that terraform destroy must not be run against that workspace.

Question 2

You are using Terraform to manage an AWS S3 bucket. You need to ensure that the bucket is not destroyed by a `terraform destroy` command, and you also want to prevent accidental deletion if the resource is removed from the configuration. Which two actions should you take? (Choose two.)

Accepted Answer

Apply an IAM policy that denies `s3:DeleteBucket` to the Terraform execution role.. The lifecycle prevent_destroy meta-argument makes Terraform refuse to destroy the resource, covering both explicit destroy and removal from configuration. An IAM policy denying s3:DeleteBucket adds a second layer that blocks the AWS API call itself. Together they ensure the bucket cannot be deleted even if Terraform is misconfigured or overridden.

Answer

Set `force_destroy = false` on the S3 bucket resource.

Answer

Add a `depends_on` to another resource to create a dependency that blocks deletion.

Answer

Enable versioning on the S3 bucket to allow recovery of deleted objects.

Question 3

You are managing a fleet of `aws_instance` resources with Terraform. You want a specific instance to be replaced whenever the value of an `aws_ami` data source changes, without changing any other attribute of the instance. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Reference the data source attribute in a `replace_triggered_by` list within the instance's lifecycle block.. replace_triggered_by is the lifecycle argument designed to force replacement when a referenced value changes, and it works by comparing the prior state value with the value computed during plan. For the comparison to be meaningful, the referenced data source must be evaluated at plan time. Combining these two actions produces automatic replacement of the instance whenever the AMI data source value changes.

Answer

Set `ignore_changes = [ami]` on the instance to force a replacement.

Answer

Mark the instance as tainted with `terraform taint` before each apply.

Answer

Add `create_before_destroy = true` to the instance's lifecycle block.

Question 4

You are managing a set of AWS resources with Terraform, including an S3 bucket and an S3 bucket policy. The bucket policy depends on the bucket's ARN. You need to ensure that whenever the bucket's ARN changes, the bucket policy is replaced. However, you also want to avoid unnecessary replacements if other attributes of the bucket change. Which configuration should you use for the aws_s3_bucket_policy resource?

Accepted Answer

lifecycle { replace_triggered_by = [aws_s3_bucket.example.arn] }. The replace_triggered_by meta-argument with the bucket's ARN attribute ensures the policy is replaced only when the ARN changes, aligning with the requirement. Using the entire resource would over-trigger, while ignore_changes and create_before_destroy do not address the triggering condition.

Answer

lifecycle { ignore_changes = [bucket] }

Answer

lifecycle { create_before_destroy = true }

Answer

lifecycle { replace_triggered_by = [aws_s3_bucket.example] }

Question 5

You are using Terraform to manage an AWS S3 bucket and its objects. You need to ensure that the bucket is not destroyed if it contains objects, but you also want to allow Terraform to delete individual objects when they are removed from configuration. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Use `aws_s3_object` resources to manage individual objects, and avoid using `aws_s3_bucket_object` (deprecated).. To prevent bucket destruction, use `prevent_destroy = true` on the bucket resource. To allow individual object deletion, manage objects with `aws_s3_object` resources. Together, these ensure the bucket is protected while objects can be deleted as configuration changes. Other options either do not prevent bucket deletion, do not allow object deletion, or are irrelevant.

Answer

Set `lifecycle { ignore_changes = [tags] }` on the S3 bucket to prevent accidental deletion.

Answer

Enable versioning on the S3 bucket to prevent object deletion.

Answer

Set `force_destroy = false` on the `aws_s3_bucket` resource.

Question 6

An operations engineer is auditing a Terraform configuration that uses the lifecycle block on several AWS resources. The team wants to prevent accidental deletion of a production RDS cluster while still allowing the configuration to be updated in place. They also want to ensure that an S3 bucket is never destroyed during routine applies but can be destroyed during an intentional teardown. Which TWO lifecycle configurations satisfy these requirements? (Choose two.)

Accepted Answer

Set prevent_destroy = true on the aws_rds_cluster resource and remove it only when an intentional destroy is required, accepting that any replacement plan will fail until the flag is removed.. prevent_destroy = true blocks any destroy or replace action while permitting in-place updates, which protects the production RDS cluster. For intentional teardown, the flag must be removed from configuration and reapplied before destroy. The S3 bucket can be protected the same way, with removal of the flag as the controlled path to deletion.

Answer

Set prevent_destroy = true on the aws_s3_bucket resource and rely on terraform destroy -target to bypass the protection during intentional teardown.

Answer

Set prevent_destroy = true on both resources and use terraform state rm to remove them from state during intentional teardown, avoiding the need to edit configuration.

Answer

Use ignore_changes = [lifecycle] on the aws_rds_cluster to prevent deletion while allowing updates, and use prevent_destroy only on the aws_s3_bucket.

Question 7

You are writing a Terraform configuration for an AWS EC2 instance. You want to ensure that the instance is replaced if its AMI ID changes, but you do not want to manage the AMI ID directly in the resource block. Which approach should you use?

Accepted Answer

Use `lifecycle { replace_triggered_by = [data.aws_ami.example.id] }` on the instance.. replace_triggered_by is designed to force replacement when a referenced resource or data source attribute changes. By referencing the AMI data source ID, any update to that value causes the EC2 instance to be replaced. This avoids managing the AMI ID directly while still reacting to changes.

Answer

Use `lifecycle { prevent_destroy = true }` on the instance.

Answer

Use `lifecycle { create_before_destroy = true }` on the instance.

Answer

Use `lifecycle { ignore_changes = [ami] }` on the instance.

Question 8

A platform team stores the AMI ID for a fleet of aws_instance resources in a variable that is updated by an external image-build pipeline. When the pipeline publishes a new AMI and updates the variable, the team wants every instance to be rebuilt on the next apply. The instances currently use lifecycle { create_before_destroy = true }. What must be added to guarantee replacement when the variable changes?

Accepted Answer

Add lifecycle { replace_triggered_by = [var.ami_id] } to the aws_instance resource.. The intent is to couple instance replacement to an external value. replace_triggered_by references the AMI variable and forces a replacement plan whenever that value changes, independent of whether the attribute is ForceNew. Ignoring changes suppresses the diff, and prevent_destroy blocks the very destruction a replacement requires.

Answer

Nothing, because changing any argument value that is not ignored always forces replacement of the resource.

Answer

Add lifecycle { prevent_destroy = true } so the instance is recreated rather than updated in place.

Answer

Add lifecycle { ignore_changes = [ami] } so Terraform detects the variable change as drift and rebuilds the instance.

Question 9

A team maintains an aws_autoscaling_group whose desired_capacity is set from a variable. They want Terraform to ignore changes to desired_capacity made by an external auto-scaling policy, but they still want Terraform to manage launch_template and min_size. They add ignore_changes = [desired_capacity] to the lifecycle block. During the next plan, Terraform still shows a diff on desired_capacity. What is the most likely explanation?

Accepted Answer

A separate resource such as aws_autoscaling_schedule is managing desired_capacity, so Terraform plans a change to reconcile the attribute outside the lifecycle rule.. ignore_changes suppresses diffs caused by changes made outside Terraform, but it does not resolve conflicts when another managed resource writes the same attribute. The persistent diff indicates a second resource is managing desired_capacity, so the team must decide which component owns that value and adjust the configuration accordingly.

Answer

ignore_changes does not apply to attributes that are also referenced by other resources in the configuration.

Answer

The diff persists because ignore_changes only suppresses changes detected between the configuration and state, not changes introduced by external systems that Terraform reads during refresh.

Answer

The attribute name in ignore_changes must match the provider schema exactly, and desired_capacity is a nested attribute that requires a different reference path.

Question 10

You have a Terraform configuration that creates an AWS Lambda function. The function's deployment package is stored in an S3 bucket, and the S3 object is updated by a separate CI/CD pipeline outside Terraform. You want Terraform to redeploy the Lambda function whenever the S3 object's ETag changes, without managing the S3 object in the same configuration. What should you do?

Accepted Answer

Add a `source_code_hash` argument to the Lambda function, referencing the S3 object's ETag via a data source.. The `source_code_hash` argument is specifically designed to trigger updates when the deployment package changes. By computing a hash from the S3 object's ETag via a data source, Terraform can detect changes and update the Lambda function in place. This avoids managing the S3 object within the same configuration while still reacting to external updates.

Answer

Set the `publish = true` argument on the Lambda function to force a new version on every apply.

Answer

Use `lifecycle { ignore_changes = [s3_key, s3_bucket] }` on the Lambda function.

Answer

Add a `lifecycle { replace_triggered_by = [aws_s3_object.package.etag] }` to the Lambda function.

Question 11

An engineer is preparing a Terraform configuration that creates an aws_instance and an aws_eip. The EIP must be associated with the instance, but the instance may be replaced during updates. The team wants the EIP association to be recreated whenever the instance changes, without manually tracking instance IDs. Which configuration approach best achieves this?

Accepted Answer

Use an aws_eip_association resource that references aws_instance.web.id, allowing Terraform to recreate the association automatically when the instance is replaced.. Referencing aws_instance.web.id inside aws_eip_association creates the dependency and ensures the association is recreated when the instance ID changes. This avoids manual ID tracking and keeps the EIP bound to the current instance across replacements without extra lifecycle churn.

Answer

Use lifecycle { ignore_changes = [instance_id] } on the aws_eip_association so the association persists across instance replacements and is reattached automatically.

Answer

Use replace_triggered_by = [aws_instance.web.id] on the aws_eip_association resource to force recreation whenever the instance ID changes.

Answer

Attach the EIP directly with an aws_eip resource that includes instance = aws_instance.web.id, and rely on the provider to update the association in place during replacement.

Question 12

You are managing an AWS Lambda function with Terraform. The function's deployment package is stored in an S3 bucket, and the aws_lambda_function resource uses the s3_bucket and s3_key arguments. A separate CI/CD pipeline updates the S3 object with a new version of the code. You want Terraform to automatically detect the new code and update the Lambda function during the next apply, without manually changing the configuration. Which approach should you take?

Accepted Answer

Use the aws_s3_object data source to fetch the S3 object's ETag, and set the source_code_hash argument to that ETag value.. To automatically detect changes to an S3 object and update a Lambda function, you can use the aws_s3_object data source to fetch the object's ETag and assign it to the source_code_hash argument. The ETag changes when the object content changes, so Terraform will see a diff and update the Lambda function. This avoids manual updates to the configuration and leverages Terraform's data sources to read current state. Other options either require manual updates or bypass Terraform's state management.

Answer

Use a null_resource with a trigger that references the S3 object's ETag via a data source, and use a local-exec provisioner to update the Lambda function.

Answer

Use the s3_object_version argument to reference a specific version of the S3 object, and update it whenever a new version is uploaded.

Answer

Set the source_code_hash argument to the base64-encoded SHA256 hash of the deployment package, and update it whenever the S3 object changes.

Question 13

You are managing an AWS Auto Scaling group with Terraform. You have configured a lifecycle hook that puts instances into a terminating:wait state. You need to ensure that Terraform can successfully destroy the Auto Scaling group without getting stuck due to instances waiting in the lifecycle hook. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the aws_autoscaling_lifecycle_hook resource with a heartbeat_timeout that is short, such as 60 seconds.. To ensure Terraform can destroy an Auto Scaling group with lifecycle hooks, you must configure the aws_autoscaling_lifecycle_hook resource with a default_result of CONTINUE and a short heartbeat_timeout. This allows instances to proceed with termination after the timeout, preventing Terraform from waiting indefinitely. The force_delete argument on the group is not sufficient, and ignore_changes or manual intervention do not address the root cause. These two settings ensure a smooth destroy operation.

Answer

Add a lifecycle configuration block to the aws_autoscaling_group resource with ignore_changes for the lifecycle hook.

Answer

Manually complete the lifecycle hook for each instance using the AWS CLI before running terraform destroy.

Answer

Set the force_delete argument to true on the aws_autoscaling_group resource.

Question 14

When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?

Accepted Answer

Resource naming collisions.. With create_before_destroy, Terraform creates the new resource before destroying the old one. If the resource has a unique name or identifier (e.g., an AWS resource with a fixed name), the new resource may conflict with the existing one, causing the plan to fail due to naming collisions.

Answer

Terraform will delete the state file.

Answer

Provider credentials will expire.

Answer

All other resources will be destroyed.

Question 15

You are managing a production database instance. You want to ensure that if a developer accidentally removes the resource block from the Terraform configuration, Terraform will refuse to destroy the database. How do you implement this?

Accepted Answer

Set prevent_destroy = true in the lifecycle block.. The 'prevent_destroy' lifecycle meta-argument, when set to true, causes Terraform to reject any plan that would destroy the resource. This includes accidental removal of the resource block from configuration, which would otherwise trigger a destroy. It acts as a safety net for critical resources like production databases.

Answer

Set create_before_destroy = false.

Answer

Use the ignore_changes meta-argument for the lifecycle block.

Answer

Configure a provider-level block to disable deletions.