Prevent Unwanted Updates in Terraform with ignore_changes

What the Hell Is ignore_changes?#

It’s a Terraform lifecycle argument that tells the engine:

“Even if this attribute has changed, don’t touch it.”

When used right, it stops Terraform from updating or replacing a resource just because some value drifted from your original config. Especially when that drift was intentional, came from outside, or just doesn’t matter.

The syntax lives inside the lifecycle block of a resource, like so:

1
lifecycle {
2
  ignore_changes = [some_attribute]
3
}

No, it doesn’t ignore all changes. And no, it’s not a get-out-of-IaC-responsibility-free card. Used carelessly, it’ll bite you. Used wisely, it’ll save your uptime and your sanity.

When Should You Use ignore_changes?#

Here are the real reasons you’d reach for it. Not made-up edge cases.

1
lifecycle {
2
  ignore_changes = [tags]
3
}

1
lifecycle {
2
  ignore_changes = [network_interface_ids]
3
}

1
lifecycle {
2
  ignore_changes = [admin_password]
3
}

Things to Know Before You Use It#

Don’t just copy-paste this like a Stack Overflow spell. Know what you’re doing:

• ignore_changes is resource-specific. You define it inside the resource, nowhere else.
• You must name each attribute exactly as Terraform sees it.
• It won’t ignore everything unless you explicitly tell it to.
• It doesn’t stop Terraform from tracking changes. It only stops it from acting on them.

Real-World Examples#

1
resource "azurerm_virtual_machine" "example" {
2
  name                  = "example-vm"
3
  location              = "UK South"
4
  resource_group_name   = azurerm_resource_group.example.name
5
  network_interface_ids = [azurerm_network_interface.example.id]
6
  vm_size               = "Standard_DS1_v2"
7

8
  storage_os_disk {
9
    name              = "example-os-disk"
10
    caching           = "ReadWrite"
11
    create_option     = "FromImage"
12
    managed_disk_type = "Premium_LRS"
13
  }
14

15
  os_profile {
16
    computer_name  = "examplevm"
17
    admin_username = "adminuser"
18
    admin_password = "3c19uA53FsTcLrB36g56" # 🔥 Don't store this here in real life
19
  }
20

21
  lifecycle {
22
    ignore_changes = [
23
      network_interface_ids,
24
      storage_os_disk,
25
      os_profile[0].computer_name,
26
    ]
27
  }
28
}

1
resource "azurerm_storage_account" "example" {
2
  name                     = "examplestorageaccount"
3
  resource_group_name      = azurerm_resource_group.example.name
4
  location                 = "East US"
5
  account_tier             = "Standard"
6
  account_replication_type = "LRS"
7

8
  lifecycle {
9
    ignore_changes = all
10
  }
11
}

Final Thoughts: Use It Like a Scalpel, Not a Sledgehammer#

ignore_changes is powerful. Too powerful, if you’re not careful.

Use it when:

• You have external systems or human changes that you don’t want Terraform to reverse
• You’re stuck with flaky, drift-prone metadata
• You need Terraform to respect reality instead of overwriting it with an idealized config

But always document why you reached for it. And review those ignores in every PR. What makes sense today can cause a surprise outage next month.