What the selected rules do to this module, before you run terraform init. Preview runs against 4.2.0, and you are viewing 4.2.2. The pinned version is fixed after review, so a new upstream release cannot change what a preview runs. Refuse or rewrite configuration that breaks the rule.
lifecycle_prevent_destroy_data Prevent accidental destruction of data-storage resources (S3, RDS instances and clusters, DynamoDB, EFS, ElastiCache replication groups) Default scope: aws_s3_bucket, aws_db_instance, aws_rds_cluster, aws_dynamodb_table, aws_efs_file_system, aws_elasticache_replication_group lifecycle_prevent_destroy_encryption Prevent destruction of KMS keys and Secrets Manager secrets Default scope: aws_kms_key, aws_secretsmanager_secret resource_restrict_instance_types Restrict EC2 instance types to cost-effective options Fixed scope: aws_instance resource_set_deletion_protection Turn on deletion protection for databases and load balancers that leave it unset, so a stray destroy cannot remove them Fixed scope: aws_db_instance, aws_rds_cluster, aws_dynamodb_table, aws_lb variable_allowed_regions Restrict the module's region variable to an org-approved allowlist Default scope: aws_* Change what Terraform does on the next apply.
eks_node_group_set_desired_size Warning Needs acknowledgement Let Terraform change a terraform-aws-eks managed node group's desired, min and max size after create, with the AWS CLI from terraform_data (upstream ignores desired_size). Opt-in: needs bash, the AWS CLI and credentials for the node group's account where terraform apply runs; the first apply pushes desired_size once, so set it to the live value first Fixed scope: aws_eks_node_group lifecycle_create_before_destroy Warning Stand up the replacement before destroying the old resource, so a security group still attached to an ENI or a certificate still bound to a listener can be replaced without a failed apply or an outage Default scope: aws_security_group, aws_acm_certificate lifecycle_ignore_ami_changes Warning Ignore AMI changes on EC2 instances and launch templates to prevent unnecessary replacements. On terraform-aws-ec2-instance the native ignore_ami_changes does the same but moves the instance to a new state address Default scope: aws_instance, aws_launch_template lifecycle_ignore_autoscaling_changes Warning Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift. On terraform-aws-dynamodb-table the native autoscaling_enabled does the same but moves the table to a new state address Default scope: aws_dynamodb_table lifecycle_ignore_deployed_artifacts Warning Ignore the artifact pointer a deployment pipeline rewrites on Lambda functions and ECS services, so the next Terraform run stops rolling the deployed version back. Assumes something other than Terraform deploys the code: do not enable it where Terraform builds the artifact (create_package = true) or builds the container image. Native alternatives: ignore_task_definition_changes on terraform-aws-ecs (moves the service to a new state address) and ignore_source_code_hash on terraform-aws-lambda (covers the zip hash only) Default scope: aws_lambda_function, aws_ecs_service lifecycle_ignore_scaling_changes Warning Ignore the capacity attribute an external autoscaler owns on ASGs, EKS node groups and ECS services, so Terraform stops reverting the scaler. No effect on terraform-aws-eks node groups or the terraform-aws-ecs service module, which already ignore it. On terraform-aws-autoscaling the native ignore_desired_capacity_changes does the same but moves the group to a new state address Default scope: aws_autoscaling_group, aws_eks_node_group, aws_ecs_service lifecycle_ignore_secret_rotation Warning Ignore the database credential attribute so a value that changes between plans - a regenerated random_password, a rotated secrets-manager or Vault data source, a variable supplied differently per runner - stops showing as a perpetual diff Default scope: aws_db_instance, aws_rds_cluster lifecycle_ignore_tag_keys Warning Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value Default scope: aws_s3_bucket lifecycle_ignore_tags Warning Ignore tag changes in lifecycle to prevent Terraform drift on managed resources Default scope: aws_* provisioner_remove_blocks Warning Remove provisioner blocks which are an anti-pattern in reusable modules s3_lifecycle_abort_incomplete_uploads Warning Require an enabled S3 lifecycle rule that aborts incomplete multipart uploads, so parts that are billed but never listed stop accumulating Fixed scope: aws_s3_bucket_lifecycle_configuration source_sanitize_content Warning Remove politically offensive content from Terraform modules Documentation and content only, with no effect on infrastructure.
doc_add_compliance_notice Info Add compliance.tf processing notice to module documentation Files: README.md doc_remove_political_section Info Remove politically charged content sections from module documentation Files: README.md doc_remove_swu_banner Info Remove Stand With Ukraine banner from module documentation Files: README.md 20 rules, catalog version 0.41.1
