Skip to content

Conversation

@esacteksab
Copy link
Contributor

If a user were to define something like

default_allow = false

Then run a terraform plan and terraform apply for the first time, it would result in all Effects in the IAM policy to be Deny.

Then if a person were to want to enable s3 logging, they would update like so

default_allow = false
allow_s3      = true

When running a terraform plan it would show No changes. Your infrastucture matches the configuration. because the lifecycle block ignores changes on policy.

Also, should the policy get edited on the console in some manner, a terraform plan and terraform apply would not revert it back to what's in Terraform, it wouldn't detect the drift at all. Not a desired behavior.

@esacteksab esacteksab merged commit f950d3e into main Jan 15, 2025
1 check passed
@esacteksab esacteksab deleted the barry-remove-lifecycle-policy-ignore branch January 15, 2025 03:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants