Using lifecycle ignore_changes for attributes managed outside of terraform

Terraform
1

Hi,

I have some deployed instances and EBS resources in AWS, all of which have EC2 tags on. I want to ensure that future changes ignore some but not all of the tags. I’ve followed the documentation but I’m getting some unexpected behaviour for tags changed outside of terrform. I’m using terraform v0.13.6 and aws provider 3.58.

The docs (The lifecycle Meta-Argument - Configuration Language | Terraform by HashiCorp) state “The ignore_changes feature is intended to be used when a resource is created with references to data that may change in the future, but should not affect said resource after its creation. In some rare cases, settings of a remote object are modified by processes outside of Terraform, which Terraform would then attempt to “fix” on the next run. In order to make Terraform share management responsibilities of a single object with a separate process, the ignore_changes meta-argument specifies resource attributes that Terraform should ignore when planning updates to the associated remote object.” Since I have processes outside of terraform that add new tags, this sounds exactly what I’m looking for.

ignore_changes seems to work with tags which are managed by terraform, but tries to set tags not managed by terraform to null.

Here’s some sample config:

resource "aws_instance" "fileserver" {
...
  lifecycle {
    ignore_changes = [
      user_data,
      tags["App_version"],
      tags["Config_version"],
      tags["hostname"],
    ]
  }
  tags = {
    "App_version"    = local.app_version
    "Config_version" = local.config_version
  }
...
}

resource "aws_ebs_volume" "volume" {
...
  lifecycle {
    ignore_changes = [
      tags["App_version"],
      tags["Config_version"],
      tags["Drive_Letter"],
    ]
  }
  tags = {
    "App_version"    = local.app_version
    "Config_version" = local.config_version
  }
}

My output is “unexpected” because if I run a tf plan where I have changed the input values for “Config_version”, this tag is ignored as expected, but the tags which are changed outside of terraform are not ignored, but instead set to null:

  # module.storage.aws_instance.fileserver will be updated in-place
  ~ resource "aws_instance" "fileserver" {
      ...
      ~ tags = {
            "App_version"    = "develop"
            "Config_version" = "feature/QWE-1234"
          - "hostname"       = "EC2AMAZ-5JJJ44G" -> null
        }
    }

  # module.storage.aws_ebs_volume.volume will be updated in-place
  ~ resource "aws_ebs_volume" "volume" {
      ...
      ~ tags = {
            "App_version"    = "develop"
            "Config_version" = "feature/QWE-1234"
          - "Drive_Letter"   = "D:" -> null
        }
    }

Are the docs wrong, is there a bug, or was this feature introduced into a later version of terraform?

Help appreciated.

Thanks.

2

Looks like this was fixed in v0.14.0:

Thanks.