Terraform create_before_destroy Lifecycle
Exhibit
resource "aws_instance" "web" {
ami = "ami-abc123"
instance_type = "t2.micro"
tags = {
Name = "web-server"
}
lifecycle {
create_before_destroy = true
}
}Refer to the exhibit. A terraform plan shows that the instance will be replaced. What will be the order of operations?
Quick Answer
The answer is that the new instance will be created first, then the old one will be destroyed. This order is dictated by the Terraform create_before_destroy lifecycle rule, which overrides the default behavior of destroying a resource before creating its replacement. By setting `create_before_destroy = true` in a resource’s lifecycle block, Terraform ensures the new resource is fully provisioned and available before the old resource is removed, minimizing downtime during updates. On the HashiCorp Terraform Associate TF-003 exam, this concept tests your understanding of lifecycle meta-arguments and how they affect resource replacement order. A common trap is assuming the default destroy-then-create order always applies, but the exam will explicitly show a `create_before_destroy` setting in the configuration. Remember the memory tip: “Build the bridge before you burn the old one” — creation always comes first when this rule is active.
⚠ Common exam trap
A common misconception is that Terraform defaults to create-before-destroy for replacements. In reality, the default is destroy-before-create. Create-before-destroy must be explicitly configured via the `lifecycle` block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destroy the old instance first, then create the new one.
By default, when Terraform replaces a resource (e.g., due to a forced-new change like `ami` or `instance_type`), it destroys the old instance first and then creates the new one. This 'destroy-before-create' behavior is the default because it ensures Terraform can cleanly remove the old resource before provisioning the replacement. To achieve zero-downtime deployments, you must explicitly set `lifecycle { create_before_destroy = true }`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance will be updated in-place without replacement.
Why it's wrong here
Incorrect. The plan indicates replacement, not in-place update.
- ✗
Both instances will be created and destroyed simultaneously.
Why it's wrong here
Incorrect. Terraform does not perform simultaneous create and destroy; operations are sequential.
- ✗
Create the new instance first, then destroy the old one.
Why it's wrong here
Incorrect. Create-before-destroy is not the default behavior; it requires explicit lifecycle configuration.
- ✓
Destroy the old instance first, then create the new one.
Why this is correct
Correct. The default replacement order is destroy-before-create.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on TF-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An operator runs 'terraform plan' and sees that a resource will be replaced. They want to avoid destroying the resource, but still apply other changes. What should they do?
medium- A.Use 'terraform apply -replace=resource_address' to replace only that resource.
- B.Add a 'lifecycle' block with 'create_before_destroy = true'.
- ✓ C.Set 'ignore_changes' to the attribute causing the replacement.
- D.Add 'prevent_destroy = true' to the resource.
Why C: To avoid destroying the resource while still applying other changes, the operator should use the `ignore_changes` lifecycle argument on the attribute that is causing the replacement. This tells Terraform to ignore changes to that specific attribute, so it will not plan a replacement. Other changes (e.g., to other attributes) can still be applied. Option A (`terraform apply -replace`) explicitly forces the replacement of a resource, which involves destroying the old one, directly contradicting the operator's goal to avoid destruction. Option B (`create_before_destroy`) does not prevent destruction; it only changes the order so the new resource is created before the old one is destroyed, but the old resource is still ultimately destroyed. Option D (`prevent_destroy`) would block any destroy operation, but it would also cause the apply to fail if a replacement is required, preventing other changes from being applied.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.