Interview › Infrastructure as Code (Terraform, Ansible)
What is the lifecycle block (create_before_destroy, prevent_destroy, ignore_changes)?
Infrastructure as Code (Terraform, Ansible) · Basic level
Answer
The lifecycle block customizes resource behavior. create_before_destroy reduces downtime by replacing before deleting when supported. prevent_destroy protects critical resources from accidental deletion. ignore_changes tells Terraform not to act on selected attribute drift, usually when another system legitimately manages that field.
Technical explanation
create_before_destroy can require unique names or extra capacity because old and new resources coexist.
prevent_destroy is a guardrail, not a backup strategy; it fails the plan if deletion is proposed.
ignore_changes should be narrow and documented.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Practice lifecycle and dependency controls for: What is the lifecycle block (create_before_destroy, prevent_destroy, ignore_changes)?
2. Add lifecycle rules deliberately:
resource "aws_db_instance" "prod" {
identifier = "prod-db"
lifecycle {
prevent_destroy = true
ignore_changes = [allocated_storage]
}
}
3. Force a reviewed replacement with:
terraform plan -replace='aws_instance.web["blue"]' -out=replace.tfplan
terraform apply replace.tfplan
4. Use depends_on only when references do not express the ordering. Then run terraform graph or inspect the plan to explain the dependency path.
5. If you use -target for recovery, immediately follow with a full terraform plan.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?