Reference · Terraform

The Apply Lifecycle & the Graph

How Terraform decides order, what runs in parallel, and what happens when an apply fails.

The graph in one paragraph

Terraform builds a DAG (directed acyclic graph) from your config: every reference is an edge (subnet referencing vpc.id ⇒ VPC first), plus any explicit depends_on edges. Apply walks the graph: a node runs as soon as all its dependencies are done, with up to 10 nodes concurrently by default (-parallelism=N to change). Order is never alphabetical, never file order — only the graph.

Source: Dependency graph internals

Implicit vs explicit dependencies

Implicit (preferred): any expression reference — vpc_id = aws_vpc.main.id. Free, automatic, exact.
Explicit (depends_on): for hidden dependencies the config can't see — e.g. an EC2 app that needs an IAM role policy to be attached before it boots, but only references the role, not the policy.
Smell: depends_on where a reference would do — it coarsens the graph (waits on the whole resource) and hides the real relationship.

Replacement order: two nodes, not one

A -/+ replace splits into a destroy node and a create node — necessary because destroy order is the reverse of create order.

Mode	Order	Trade-off
Default	destroy old → create new	Downtime window; safe for unique names
`create_before_destroy`	create new → destroy old	No gap — but old + new must coexist (unique names break it). Opt-in via `lifecycle {}`.

Source: lifecycle meta-argument

When an apply fails — the part nobody tells you

There is no rollback. Terraform is not transactional. Resources already created stay created and stay in state; the failed resource is recorded as tainted if it half-exists (created but provisioning failed); everything downstream is simply not attempted. The fix is normal: correct the problem, run apply again — Terraform resumes from where reality is. Tainted resources are planned as -/+ replace on the next run.

terraform apply -replace=ADDR — force a replace of a suspect resource (modern successor to the deprecated terraform taint).
Partial applies are why state + idempotent re-apply is the recovery model — not transactions.

Other lifecycle controls

Tool	What it does	Caution
`prevent_destroy = true`	Plan that would destroy this resource → hard error	Lives in the block — deleting the whole block removes the guard too
`ignore_changes = [attr]`	Diff ignores those attributes (tolerated drift)	Permanent blind spot — document why
`-target=ADDR`	Apply only ADDR + its dependencies	Emergency tool. Routine use leaves state diverged from config
`-parallelism=N`	Concurrency of the graph walk (default 10)	Raising it mostly moves the bottleneck to API rate limits
`terraform graph`	Dump the DAG (DOT format)	Pipe to Graphviz to actually see it