How Terraform infers resource dependencies from expressions and when an explicit depends_on relationship is appropriate.
Terraform constructs a dependency graph from configuration so it can create, update, and destroy resources in an appropriate order. In most cases, a reference to another resource creates the dependency automatically. HashiCorp’s resource-dependency documentation explains that Terraform analyzes expressions to find those references.
In this example, the instance uses the subnet ID from aws_subnet.app. That expression gives Terraform both the value it needs and the dependency edge it needs; no depends_on is required.
1resource "aws_subnet" "app" {
2 vpc_id = aws_vpc.app.id
3 cidr_block = "10.0.1.0/24"
4}
5
6resource "aws_instance" "app" {
7 ami = var.ami_id
8 subnet_id = aws_subnet.app.id
9}
Terraform does not use the order of blocks in a file as the primary source of execution order. Independent resources can be processed in parallel, while a resource that references another waits for the required dependency actions.
depends_onUse the depends_on meta-argument only for a real hidden dependency: one object needs another object’s behavior to exist, but its arguments do not refer to data from that object. For example, an application service might need an IAM policy attachment to be created before its first startup, even though no argument in the service resource references the attachment.
1resource "aws_iam_role_policy_attachment" "logs" {
2 role = aws_iam_role.app.name
3 policy_arn = aws_iam_policy.logs.arn
4}
5
6resource "aws_instance" "app" {
7 ami = var.ami_id
8 instance_type = "t3.micro"
9
10 depends_on = [aws_iam_role_policy_attachment.logs]
11}
Explain every explicit dependency in a comment close to the declaration. As HashiCorp’s depends_on reference notes, unnecessary explicit dependencies make plans more conservative and can cause more values to be unknown until apply.
You do not need to generate a graph image for ordinary reviews. Read the plan for unexpected replacements, ordering-sensitive changes, and values marked “known after apply.” If Terraform seems to miss a relationship, first see whether the downstream resource can directly reference the upstream value. That gives Terraform more precise information than a broad depends_on edge.