Allow exempting selected elements of map attribute in lifecycle ignore_changes

[rafabu]

Current Terraform Version

Terraform v1.0.7

Use-cases

Every now and again there is a need to assure, terraform only manages a subset of values in an attribute of type map. Specifically with resource tags:
While most tags of a cloud resource may be changed by downstream processes throughout the entire lifecycle of a resource, a few selected ones must remain under control of the IaC workflows.

Proposal

Currently we can ignore specific tags by listing their keys

resource "any_instance" "example" {

  lifecycle {
    ignore_changes = [
     tags["IgnoreThisTagKey01"],
     tags["IgnoreThisTagKey02"]
    ]
   # or exclude everything (just create & destroy)
   # ignore_changes = all
  }
}

but we would need something like

resource "any_instance" "example" {

  lifecycle {
    ignore_changes = [
    # ignore all resource tags
     tags
    ]
    ignore_changes_exemptions = [
    # but the ones listed here
     tags["UpdateThisTagKey01"],
     tags["UpdateThisTagKey02"],
    ]
  }
}

in order to ignore all but selected keys.

References

Similar requests - also with wildcards and/or on complex attributes:

• Allow selecting attribute of all elements of a collection in ignore_changes #29394
• Allow terraform's ignore_changes to ignore everything except INCLUDED attributes #26372

[apparentlymart]

Hi @rafabu! Thanks for sharing this use-case.

At the moment we're not planning any modifications to the ignore_changes behavior, since its current implementation is already quite tricky in how it works and would likely need to be revisited in order to change its behavior in any significant way. This is a feature that came pretty early in Terraform's life which we now can see with hindsight has some design problems that, due to our 1.0 compatibility promises, we may need to address with replacement features rather than additions to the existing feature.

However, this is still a valid use-case and so we can use this issue to represent the use-case even though the final design to meet that use-case, once we get there, will probably be something separate from ignore_changes, for the reason I described above.

In the meantime though, I think having a subset of AWS tags be managed separately from Terraform is a common enough use-case that the AWS provider already has a specialized solution for it. The Resource Tagging guide describes how you can configure the provider to ignore certain tag names and some other similar possibilities. Those features belong to the AWS provider rather than to Terraform Core, so if you have feedback about them it'd be best to send it to the AWS provider repository.

[rafabu]

I will have a look at the aws guide - however; we are working mostly with azurerm resources. So we will have to wait until the redesigned, versatile ignore_changes successor sees the light of the day.

[apparentlymart]

You could also send the Azure provider team feedback about your use-case. Specialized features addressing one concrete problem are almost always easier and faster to design than general solutions, and the experience with specialized solutions often informs the general ones, so I'd always suggest pursuing the more specialized answer first if the lack of a particular feature is causing you significant problems.