How does Terraform handle resource lifecycle with create_before_destroy and prevent_destroy?
Learn how Terraform's lifecycle block uses create_before_destroy for zero-downtime replacement and prevent_destroy to guard critical resources from deletion.
Expected Interview Answer
The lifecycle block lets you override Terraform's default replace behavior: create_before_destroy provisions a replacement resource before deleting the old one to avoid downtime, while prevent_destroy blocks any plan that would delete the resource, guarding critical infrastructure.
By default Terraform destroys a resource before creating its replacement, which can cause an outage or a naming collision. Setting create_before_destroy = true reverses that order so the new resource exists before the old one is removed, though it requires unique names and can briefly double capacity. prevent_destroy = true makes Terraform error out on any plan that would destroy the resource, protecting databases or state buckets from accidental deletion. Both live inside a resource's lifecycle block, and create_before_destroy can cascade to dependencies that must also be recreated first.
- create_before_destroy avoids downtime during replacements
- prevents naming collisions by ordering creation first
- prevent_destroy guards critical resources from accidental deletion
- Makes replacement behavior explicit and reviewable
- Supports safe blue-green style resource swaps
AI Mentor Explanation
create_before_destroy is sending the next batter to warm up and reach the crease before the current one walks off, so the innings never pauses. prevent_destroy is the umpire refusing to let a not-out star batter be removed no matter what the fielding side claims — the replacement is ready before the swap, and the protected player simply cannot be sent off by mistake.
Step-by-Step Explanation
Step 1
Add a lifecycle block
Inside the resource, declare a lifecycle { } block to override default behavior.
Step 2
Enable create_before_destroy
Set create_before_destroy = true so Terraform provisions the replacement before deleting the old resource.
Step 3
Ensure unique naming
Give resources computed or randomized names so the new and old can coexist without collision.
Step 4
Add prevent_destroy where needed
Set prevent_destroy = true on critical resources so any destroying plan errors out.
Step 5
Review cascading effects
Understand that create_before_destroy can force dependent resources to be recreated first too.
What Interviewer Expects
- Knowing the default replace order is destroy-then-create
- Explaining how create_before_destroy avoids downtime
- Awareness of naming collisions and the need for unique names
- Understanding prevent_destroy blocks destroying plans with an error
- Recognizing cascading recreation of dependencies
Common Mistakes
- Assuming create_before_destroy has no naming constraints
- Thinking prevent_destroy stops all changes, not just destruction
- Forgetting prevent_destroy also blocks intentional terraform destroy
- Ignoring temporary double capacity and cost during replacement
- Not accounting for cascading recreation of dependent resources
Best Answer (HR Friendly)
“create_before_destroy tells Terraform to build the new version of something before removing the old one, so there's no downtime. prevent_destroy is a safety lock that stops Terraform from deleting critical things like a production database by accident.”
Code Example
resource "aws_instance" "web" {
ami = var.ami_id
instance_type = "t3.micro"
lifecycle {
create_before_destroy = true
}
}
resource "aws_db_instance" "prod" {
identifier = "prod-db"
engine = "postgres"
lifecycle {
prevent_destroy = true
}
}Follow-up Questions
- What happens if you try to destroy a resource with prevent_destroy = true?
- Why does create_before_destroy require unique resource names?
- How does create_before_destroy cascade to dependent resources?
- What are the cost implications of create_before_destroy?
- Can prevent_destroy be bypassed, and how?
MCQ Practice
1. What is Terraform's default replacement order?
By default Terraform destroys the old resource before creating the replacement, which create_before_destroy reverses.
2. What does prevent_destroy = true do?
prevent_destroy makes Terraform fail with an error on any plan that would destroy the resource.
3. A common requirement when using create_before_destroy is:
Because old and new resources coexist briefly, names must be unique to avoid a collision.
Flash Cards
Default replace order? — Destroy the old resource, then create the new one.
create_before_destroy effect — Creates the replacement first, then destroys the old resource to avoid downtime.
prevent_destroy effect — Errors out any plan that would destroy the resource, protecting critical infrastructure.
Where do these go? — Inside a resource's lifecycle { } block.