Terraformのlifecycleブロックで本番リソースを誤削除から守る方法｜prevent_destroyとignore_changesの実践設計

この記事のポイント

・prevent_destroy = true で誤ったdestroy/replace操作をエラーでブロックできる
・create_before_destroyでALB・セキュリティグループのゼロダウンタイム置換を実現する
・ignore_changesでコンソール手動変更によるドリフトを安全に吸収できる
・RDSにはDeletion Protectionとの二重防護でより確実に誤削除を防げる

resource "aws_db_instance" "prod_db" {
  identifier     = "prod-mysql-01"
  engine         = "mysql"
  instance_class = "db.t3.medium"

  lifecycle {
    prevent_destroy       = true       # 削除をエラーでブロック
    create_before_destroy = false      # 通常はfalse
    ignore_changes        = [password] # 指定属性の差分を無視
  }
}

$ terraform destroy -target=aws_db_instance.prod_db

Planning...
╵
│ Error: Instance cannot be destroyed
│
│   on rds.tf line 22, in resource "aws_db_instance" "prod_db":
│   22:     prevent_destroy = true
│
│ Resource aws_db_instance.prod_db has lifecycle.prevent_destroy set,
│ but the plan calls for this resource to be destroyed. To avoid this
│ error and continue with the plan, either disable lifecycle.prevent_destroy
│ or adjust the scope of the plan using the -target flag.
╴

resource "aws_security_group" "alb_sg" {
  # name ではなく name_prefix を使う（古いSGと名前が衝突しないようにする）
  name_prefix = "alb-sg-"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  lifecycle {
    create_before_destroy = true
  }
}

$ terraform plan

  # aws_security_group.alb_sg must be replaced
+/- resource "aws_security_group" "alb_sg" {
      ~ id   = "sg-0a1b2c3d4e5f67890" -> (known after apply)
      ~ name = "alb-sg-20240101120000" -> (known after apply) # forces replacement
    }

Plan: 1 to add, 0 to change, 1 to destroy.

resource "aws_autoscaling_group" "web" {
  name             = "web-asg"
  desired_capacity = 2
  min_size         = 1
  max_size         = 10

  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }

  lifecycle {
    # desired_capacity は Auto Scaling ポリシーが動的に変更するため無視
    # tags はコンソールで追加管理しているため無視
    ignore_changes = [desired_capacity, tags]
  }
}

resource "aws_db_instance" "prod_db" {
  identifier             = "prod-mysql-01"
  engine                 = "mysql"
  engine_version         = "8.0.35"
  instance_class         = "db.t3.medium"
  allocated_storage      = 100
  db_name                = "appdb"
  username               = "admin"
  password               = var.db_password
  multi_az               = true
  skip_final_snapshot    = false
  final_snapshot_identifier = "prod-mysql-final-snapshot"
  deletion_protection    = true    # RDS側のDeletion Protectionも必ず有効化する

  lifecycle {
    prevent_destroy = true
    ignore_changes  = [
      password,        # Secrets Managerのローテーション対応
      engine_version,  # マイナーバージョン自動アップグレードを許可している場合
    ]
  }
}

resource "aws_security_group" "alb_sg" {
  name_prefix = "alb-sg-"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_lb" "web" {
  name               = "web-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = var.public_subnet_ids
}

resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  validation_method = "DNS"

  subject_alternative_names = [
    "*.example.com",
  ]

  lifecycle {
    create_before_destroy = true
  }
}

# tfstateからリソースの実際の属性名を確認する
$ terraform state show aws_autoscaling_group.web

# aws_autoscaling_group.web:
resource "aws_autoscaling_group" "web" {
    arn                  = "arn:aws:autoscaling:ap-northeast-1:012345678901:..."
    desired_capacity     = 3     # ← この属性名を ignore_changes に指定する
    min_size             = 1
    max_size             = 10
    ...
}