What the selected rules do to this module, before you run terraform init. Preview is not available for this module. It runs the rules engine on demand, so it is offered on a reviewed set of modules at a pinned version rather than on the whole registry. Everything on this page still applies - the source URL above, with the rules you select on ?add_rules=, works on any module. To see a diff, run one on a previewable module in the Playground . Refuse or rewrite configuration that breaks the rule.
lifecycle_prevent_destroy_data Prevent accidental destruction of data-storage resources (S3, RDS instances and clusters, DynamoDB, EFS, ElastiCache replication groups) Default scope: aws_s3_bucket, aws_db_instance, aws_rds_cluster, aws_dynamodb_table, aws_efs_file_system, aws_elasticache_replication_group lifecycle_prevent_destroy_encryption Prevent destruction of KMS keys and Secrets Manager secrets Default scope: aws_kms_key, aws_secretsmanager_secret resource_restrict_instance_types Restrict EC2 instance types to cost-effective options Fixed scope: aws_instance resource_set_deletion_protection Turn on deletion protection for databases and load balancers that leave it unset, so a stray destroy cannot remove them Fixed scope: aws_db_instance, aws_rds_cluster, aws_dynamodb_table, aws_lb variable_allowed_regions Restrict the module's region variable to an org-approved allowlist Default scope: aws_* Change what Terraform does on the next apply.
eks_node_group_set_desired_size Warning Needs acknowledgement Let Terraform change a terraform-aws-eks managed node group's desired, min and max size after create, with the AWS CLI from terraform_data (upstream ignores desired_size). Opt-in: needs bash, the AWS CLI and credentials for the node group's account where terraform apply runs; the first apply pushes desired_size once, so set it to the live value first Fixed scope: aws_eks_node_group lifecycle_create_before_destroy Warning Stand up the replacement before destroying the old resource, so a security group still attached to an ENI or a certificate still bound to a listener can be replaced without a failed apply or an outage Default scope: aws_security_group, aws_acm_certificate lifecycle_ignore_ami_changes Warning Ignore AMI changes on EC2 instances and launch templates to prevent unnecessary replacements. On terraform-aws-ec2-instance the native ignore_ami_changes does the same but moves the instance to a new state address Default scope: aws_instance, aws_launch_template lifecycle_ignore_autoscaling_changes Warning Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift. On terraform-aws-dynamodb-table the native autoscaling_enabled does the same but moves the table to a new state address Default scope: aws_dynamodb_table lifecycle_ignore_deployed_artifacts Warning Ignore the artifact pointer a deployment pipeline rewrites on Lambda functions and ECS services, so the next Terraform run stops rolling the deployed version back. Assumes something other than Terraform deploys the code: do not enable it where Terraform builds the artifact (create_package = true) or builds the container image. Native alternatives: ignore_task_definition_changes on terraform-aws-ecs (moves the service to a new state address) and ignore_source_code_hash on terraform-aws-lambda (covers the zip hash only) Default scope: aws_lambda_function, aws_ecs_service lifecycle_ignore_scaling_changes Warning Ignore the capacity attribute an external autoscaler owns on ASGs, EKS node groups and ECS services, so Terraform stops reverting the scaler. No effect on terraform-aws-eks node groups or the terraform-aws-ecs service module, which already ignore it. On terraform-aws-autoscaling the native ignore_desired_capacity_changes does the same but moves the group to a new state address Default scope: aws_autoscaling_group, aws_eks_node_group, aws_ecs_service lifecycle_ignore_secret_rotation Warning Ignore the database credential attribute so a value that changes between plans - a regenerated random_password, a rotated secrets-manager or Vault data source, a variable supplied differently per runner - stops showing as a perpetual diff Default scope: aws_db_instance, aws_rds_cluster lifecycle_ignore_tag_keys Warning Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value Default scope: aws_s3_bucket lifecycle_ignore_tags Warning Ignore tag changes in lifecycle to prevent Terraform drift on managed resources Default scope: aws_* provisioner_remove_blocks Warning Remove provisioner blocks which are an anti-pattern in reusable modules s3_lifecycle_abort_incomplete_uploads Warning Require an enabled S3 lifecycle rule that aborts incomplete multipart uploads, so parts that are billed but never listed stop accumulating Fixed scope: aws_s3_bucket_lifecycle_configuration source_sanitize_content Warning Remove politically offensive content from Terraform modules Documentation and content only, with no effect on infrastructure.
doc_add_compliance_notice Info Add compliance.tf processing notice to module documentation Files: README.md doc_remove_political_section Info Remove politically charged content sections from module documentation Files: README.md doc_remove_swu_banner Info Remove Stand With Ukraine banner from module documentation Files: README.md 20 rules, catalog version 0.41.1
