eks_node_group_set_desired_size warning ack required Let Terraform change a terraform-aws-eks managed node group's desired, min and max size after create, with the AWS CLI from terraform_data (upstream ignores desired_size). Opt-in: needs bash, the AWS CLI and credentials for the node group's account where terraform apply runs; the first apply pushes desired_size once, so set it to the live value first fixed scope aws_eks_node_group lifecycle_create_before_destroy warning Stand up the replacement before destroying the old resource, so a security group still attached to an ENI or a certificate still bound to a listener can be replaced without a failed apply or an outage default scope aws_security_group aws_acm_certificate lifecycle_ignore_ami_changes warning Ignore AMI changes on EC2 instances and launch templates to prevent unnecessary replacements. On terraform-aws-ec2-instance the native ignore_ami_changes does the same but moves the instance to a new state address default scope aws_instance aws_launch_template lifecycle_ignore_autoscaling_changes warning Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift. On terraform-aws-dynamodb-table the native autoscaling_enabled does the same but moves the table to a new state address default scope aws_dynamodb_table lifecycle_ignore_deployed_artifacts warning Ignore the artifact pointer a deployment pipeline rewrites on Lambda functions and ECS services, so the next Terraform run stops rolling the deployed version back. Assumes something other than Terraform deploys the code: do not enable it where Terraform builds the artifact (create_package = true) or builds the container image. Native alternatives: ignore_task_definition_changes on terraform-aws-ecs (moves the service to a new state address) and ignore_source_code_hash on terraform-aws-lambda (covers the zip hash only) default scope aws_lambda_function aws_ecs_service lifecycle_ignore_scaling_changes warning Ignore the capacity attribute an external autoscaler owns on ASGs, EKS node groups and ECS services, so Terraform stops reverting the scaler. No effect on terraform-aws-eks node groups or the terraform-aws-ecs service module, which already ignore it. On terraform-aws-autoscaling the native ignore_desired_capacity_changes does the same but moves the group to a new state address default scope aws_autoscaling_group aws_eks_node_group aws_ecs_service lifecycle_ignore_secret_rotation warning Ignore the database credential attribute so a value that changes between plans - a regenerated random_password, a rotated secrets-manager or Vault data source, a variable supplied differently per runner - stops showing as a perpetual diff default scope aws_db_instance aws_rds_cluster lifecycle_ignore_tag_keys warning Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value default scope aws_s3_bucket lifecycle_ignore_tags warning Ignore tag changes in lifecycle to prevent Terraform drift on managed resources default scope aws_* provisioner_remove_blocks warning Remove provisioner blocks which are an anti-pattern in reusable modules s3_lifecycle_abort_incomplete_uploads warning Require an enabled S3 lifecycle rule that aborts incomplete multipart uploads, so parts that are billed but never listed stop accumulating fixed scope aws_s3_bucket_lifecycle_configuration source_sanitize_content warning Remove politically offensive content from Terraform modules