Skip to content
Cheat sheets

004 · Domain 4: Terraform configuration · 13% of the exam

Task 4.6: Define resource dependencies in configuration

Implicit dependencies from references, depends_on for hidden ones, and lifecycle rules that change the order of replacement such as create_before_destroy.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

An application on an instance reads a bucket at startup through the instance's IAM role. The role policy that grants bucket access is a separate resource, and nothing in the instance's arguments refers to it. Sometimes the app starts before the policy exists. What fixes the order?

  1. AMove the policy block above the instance block in the same file
  2. BAdd lifecycle { ignore_changes = all } to the instance
  3. CAdd depends_on = [aws_iam_role_policy.bucket_read] to the instance
  4. DRun the apply with -parallelism=1 so resources are created one at a time
Show the answer and why

  • AMove the policy block above the instance block in the same file

    Incorrect

    Block order does not affect the dependency graph.

  • BAdd lifecycle { ignore_changes = all } to the instance

    Incorrect

    ignore_changes stops updates to attributes; it does not order creation.

  • CAdd depends_on = [aws_iam_role_policy.bucket_read] to the instance

    Correct

    depends_on handles hidden dependencies that Terraform cannot infer, when a resource relies on another's behavior without referencing its data.

  • DRun the apply with -parallelism=1 so resources are created one at a time

    Incorrect

    Lower parallelism does not guarantee the policy comes first.

References create dependencies automatically; depends_on is for the ones Terraform cannot see.

HashiCorp documentation

Task 4.6Report a problem with this question

Question 2 · choose 1

Before a refactor, an engineer wants a picture of how the resources in a configuration depend on each other, to confirm that the database waits for its subnet group. Which command produces it?

  1. Aterraform graph, which outputs the dependency graph for visualizing
  2. Bterraform providers, which lists every resource under the provider it depends on
  3. Cterraform show, which draws the dependency tree of the current state
  4. Dterraform plan -parallelism=1, which processes the resources in dependency order
Show the answer and why

  • Aterraform graph, which outputs the dependency graph for visualizing

    Correct

    By default, terraform graph prints the dependency ordering of the resources in DOT format; -type=plan adds more detail.

  • Bterraform providers, which lists every resource under the provider it depends on

    Incorrect

    providers shows the provider requirements of the configuration and its modules, not how resources depend on each other.

  • Cterraform show, which draws the dependency tree of the current state

    Incorrect

    show prints the state or a saved plan in readable form; it does not draw dependencies.

  • Dterraform plan -parallelism=1, which processes the resources in dependency order

    Incorrect

    -parallelism limits how many operations run at once; the plan output is not a map of the dependencies.

Terraform plans and applies by walking a dependency graph; terraform graph lets you look at the resource ordering instead of guessing.

HashiCorp documentation

Task 4.6Report a problem with this question

Question 3 · choose 1

An engineer tries depends_on = var.enable_db ? [aws_db_instance.main] : []. Terraform reports an error. Why?

  1. Adepends_on must reference a module, not a resource
  2. BConditional expressions cannot return lists in any argument of a resource
  3. Cdepends_on is allowed only on data blocks
  4. Ddepends_on takes only a static list of references
Show the answer and why

  • Adepends_on must reference a module, not a resource

    Incorrect

    depends_on can reference resources and modules.

  • BConditional expressions cannot return lists in any argument of a resource

    Incorrect

    Conditionals can return lists elsewhere; depends_on is the special case.

  • Cdepends_on is allowed only on data blocks

    Incorrect

    It works on resources, data blocks and modules.

  • Ddepends_on takes only a static list of references

    Correct

    depends_on cannot include arbitrary expressions, because it must be known before Terraform can evaluate expressions.

Dependencies are structural, decided before any expression is evaluated.

HashiCorp documentation

Task 4.6Report a problem with this question

Question 4 · choose 1

A team wants Terraform to create a jump host and, weeks later, destroy it, but never to update it in place in between, whatever changes in the configuration or outside it. Which setting does this?

  1. Alifecycle { ignore_changes = [ami, instance_type] }, listing the arguments that usually change
  2. Blifecycle { ignore_changes = all }
  3. Clifecycle { prevent_update = true }
  4. DA data block for the host after its first apply, so Terraform only reads it
Show the answer and why

  • Alifecycle { ignore_changes = [ami, instance_type] }, listing the arguments that usually change

    Incorrect

    A list ignores only the attributes it names; changes to any other argument would still be planned as updates.

  • Blifecycle { ignore_changes = all }

    Correct

    With the keyword all, Terraform never updates the object but can still create or destroy it.

  • Clifecycle { prevent_update = true }

    Incorrect

    The lifecycle block has no such argument; Terraform reports it as unsupported.

  • DA data block for the host after its first apply, so Terraform only reads it

    Incorrect

    A data block stops Terraform from managing the host at all, so it could no longer destroy it either.

ignore_changes = all freezes a resource between creation and destruction. Use it sparingly: legitimate configuration changes are ignored too.

HashiCorp documentation

Task 4.6Report a problem with this question

Question 5 · choose 1

A module that configures monitoring must wait until a whole networking module has finished, but it uses none of that module's outputs. What expresses this?

  1. Aproviders = { network = module.network }
  2. BA moved block from the network module to the monitoring module
  3. Cdepends_on = [module.network] in the monitoring module block
  4. DNothing; modules always run one after another
Show the answer and why

  • Aproviders = { network = module.network }

    Incorrect

    providers passes provider configurations, not dependencies.

  • BA moved block from the network module to the monitoring module

    Incorrect

    moved blocks record address changes.

  • Cdepends_on = [module.network] in the monitoring module block

    Correct

    depends_on can be used in module blocks and can reference an entire module.

  • DNothing; modules always run one after another

    Incorrect

    Modules are part of one graph and run in parallel where possible.

Whole-module dependencies use depends_on on the module block.

HashiCorp documentation

Task 4.6Report a problem with this question

Question 6 · choose 1

An autoscaling process changes an instance group's desired_capacity all day, and every plan proposes to set it back. The team wants Terraform to set the initial value but then leave it alone. What should they add?

  1. Alifecycle { prevent_destroy = true }
  2. Bdepends_on on the autoscaling process
  3. Clifecycle { ignore_changes = [desired_capacity] }
  4. DA provisioner that resets desired_capacity after every apply
Show the answer and why

  • Alifecycle { prevent_destroy = true }

    Incorrect

    That stops destroy plans; it does not ignore attribute changes.

  • Bdepends_on on the autoscaling process

    Incorrect

    depends_on orders operations; it does not ignore changes.

  • Clifecycle { ignore_changes = [desired_capacity] }

    Correct

    ignore_changes lets Terraform share management of an object with another process by ignoring the listed attributes after creation.

  • DA provisioner that resets desired_capacity after every apply

    Incorrect

    Provisioners are a last resort, and this one would fight the autoscaling process.

ignore_changes marks attributes that another process owns after creation.

HashiCorp documentation

Task 4.6Report a problem with this question

Practise domain 4 →Practise all domains →