Terraform Lifecycle Ignore Changes Syntax

The Incident (What does the error mean?)

Raw error output from terraform plan or terraform validate:

Error: Invalid attribute reference

  on main.tf line 18, in resource "aws_instance" "web":
  18:     ignore_changes = ["tags", "ami"]

References in ignore_changes must be to attributes of the resource itself.
An attribute reference must be an attribute access expression, not a quoted
string or other expression.

or alternatively:

Error: Invalid expression

  on main.tf line 21, in resource "aws_launch_template" "app":
  21:     ignore_changes = [var.ignored_attr]

A single static variable reference is not allowed here.

Immediate consequence: Terraform exits non-zero. No plan is generated. No apply proceeds. In a CI/CD pipeline this blocks every downstream deployment stage. If this resource manages a stateful workload (RDS, EKS node group, ASG), your automation is dead until the syntax is corrected and the pipeline is re-triggered.

The Attack Vector / Blast Radius

This is a pipeline-killing syntax error, not a runtime misconfiguration — meaning it surfaces at parse time and kills the entire Terraform run, not just the affected resource. Blast radius:

• All resources in the module are blocked from plan/apply, not just the offending one. A single bad ignore_changes block in one resource locks your entire state.
• Automated drift remediation fails silently in scheduled pipelines. If your ignore_changes was protecting a production resource from unwanted drift (e.g., user_data on a running EC2 instance), and the fix attempt introduces this syntax error, you've now also lost your drift protection.
• State lock accumulation: In Terraform Cloud / Atlantis, a failed plan that doesn't release the state lock cleanly can block concurrent workspace runs, requiring manual terraform force-unlock.
• The var.* variant is particularly dangerous: Engineers attempting to make ignore_changes dynamic (a reasonable instinct) hit this error and may attempt workarounds like dynamic blocks inside lifecycle — which Terraform explicitly forbids. This wastes significant debugging time.

Prevention in CI/CD

1. terraform validate as a pre-commit gate

This error is caught by terraform validate before any plan. Wire it into pre-commit:

# .pre-commit-config.yaml
- repo: https://github.com/antonbabenko/pre-commit-terraform
  hooks:
    - id: terraform_validate
    - id: terraform_tflint

2. TFLint rule for lifecycle blocks

# .tflint.hcl
plugin "terraform" {
  enabled = true
  version = "0.5.0"
  source  = "github.com/terraform-linters/tflint-ruleset-terraform"
}

rule "terraform_required_version" {
  enabled = true
}

TFLint catches invalid ignore_changes references and several other lifecycle misconfigurations at lint time, before terraform init is even required.

3. Checkov policy (static analysis)

checkov -d . --framework terraform

Checkov parses HCL statically and will surface this as a parse failure in its output, blocking the CI stage.

4. CI pipeline gate (GitHub Actions example)

- name: Terraform Validate
  run: |
    terraform init -backend=false
    terraform validate
  env:
    TF_CLI_ARGS: "-no-color"

Run terraform validate with -backend=false so it doesn't require real credentials — this makes it safe and fast for every PR.