How Terraform validates inputs, controls replacement lifecycle, and limits exposure of sensitive or temporary values.
Terraform can validate assumptions, adjust resource lifecycle behavior, and mark values for safer handling. These are separate controls; a dependency or lifecycle setting is not input validation.
1variable "environment" {
2 type = string
3 validation {
4 condition = contains(["dev", "staging", "prod"], var.environment)
5 error_message = "Environment must be dev, staging, or prod."
6 }
7}
Variable validation rejects unsuitable caller input early. Preconditions, postconditions, and check blocks apply assertions at different points in an operation. terraform validate checks configuration structure; it does not replace domain-specific assertions.
create_before_destroy can reduce downtime during replacement, but it may need extra capacity and cannot overcome provider uniqueness constraints. Prefer inferred dependencies over depends_on; see Terraform resource dependencies.
Marking a value sensitive redacts it in normal output but may still persist it in state. Where supported by the Terraform and provider versions in use, ephemeral values and write-only arguments avoid persistence in state and plan files. HashiCorp’s sensitive-data guide explains their restrictions.