Terraform中如何配置lifecycle.ignore_changes以忽略块内所有属性变更并添加例外项

Absolutely, this is a common pain point when dealing with nested blocks packed with configurable properties—especially with resources like Azure App Service's site_config, where many settings might shift post-deployment via user interactions. Unfortunately, Terraform doesn’t have a built-in "ignore all except X" syntax for ignore_changes directly, but there are two solid workarounds to avoid manually maintaining a long, error-prone list of ignored properties.

Option 1: Use ignore_changes = [block.*] with replace_triggered_by (destructive but simple) #

If you can tolerate rebuilding the resource when your critical property changes (this triggers a destroy-and-recreate instead of an in-place update), you can ignore the entire nested block and tie the resource’s lifecycle to your exception property.

For your Azure App Service example:

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    always_on                = var.always_on  # Track changes to this property
    http2_enabled            = var.http2_enabled
    min_tls_version          = "1.2"
    # ... dozens of other site_config properties prone to post-deployment changes
  }

  lifecycle {
    # Ignore every property in the first (and usually only) site_config block
    ignore_changes = [site_config[0].*]
    # Trigger a resource replace when the critical "always_on" variable changes
    replace_triggered_by = [var.always_on]
  }
}

Key Notes: #

• ignore_changes = [site_config[0].*] tells Terraform to disregard all changes to the site_config block, regardless of what users modify post-deployment.
• replace_triggered_by watches for changes to your var.always_on value; when you update this variable in your config, Terraform will mark the App Service for replacement to apply the change.
• Keep in mind: replacing an App Service causes downtime, so reserve this for rare critical property changes or if you have a downtime-tolerant deployment strategy.

Option 2: Dynamically generate the ignore_changes list (in-place updates, zero maintenance) #

If you want to avoid resource replacement and keep in-place updates for your exception properties, you can use Terraform’s built-in functions to automatically generate the list of properties to ignore—excluding your critical ones.

Here’s how to implement this for Azure App Service:

# Step 1: Centralize all site_config properties in a local value
locals {
  site_config_full = {
    always_on                = var.always_on  # Don't ignore this property
    http2_enabled            = var.http2_enabled
    min_tls_version          = "1.2"
    ftps_state               = "Disabled"
    scm_type                 = "None"
    # ... add all other site_config properties here
  }

  # Step 2: Generate ignore list automatically (exclude "always_on")
  ignored_site_config_props = [
    for prop_name in keys(local.site_config_full) :
    "site_config[0].${prop_name}"
    if prop_name != "always_on"
  ]
}

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  app_service_plan_id = azurerm_app_service_plan.example.id

  # Step 3: Map centralized properties to the resource block
  site_config {
    always_on                = local.site_config_full.always_on
    http2_enabled            = local.site_config_full.http2_enabled
    min_tls_version          = local.site_config_full.min_tls_version
    ftps_state               = local.site_config_full.ftps_state
    scm_type                 = local.site_config_full.scm_type
    # ... map all other properties from local.site_config_full
  }

  lifecycle {
    # Step 4: Use the dynamically generated ignore list
    ignore_changes = local.ignored_site_config_props
  }
}

How this works: #

• By centralizing all site_config properties in local.site_config_full, you only need to update this one place when adding or removing properties.
• The ignored_site_config_props local value uses a for expression to iterate over all property keys, excluding your exception (always_on), and formats each into the path Terraform expects for ignore_changes.
• Terraform will ignore changes to all properties in the generated list, but still detect and plan in-place updates for always_on when its value changes in your configuration.

Key Notes: #

• This approach eliminates manual maintenance of the ignore_changes list—any new/removed properties in site_config_full are automatically included/excluded from the ignore list.
• It preserves in-place updates for your critical property, avoiding downtime for your App Service.

Summary #

• Use Option 1 for a simple setup if you can tolerate resource replacement when your exception property changes.
• Use Option 2 for scalable, zero-maintenance in-place updates—this is the best choice for nested blocks with many properties that evolve over time.

内容的提问来源于stack exchange，提问作者Ranika Nisal