FULL AI ANALYSIS

Terraform repeatedly wants to recreate AWS security groups due to non-deterministic 'tags' ordering in provider responses

Generated Oct 14, 2026, 9:39:02 AM

Analysis summary

Terraform's plan detects differences between the desired configuration and state. AWS tags are unordered by nature; some provider/resource schemas may normalize tags differently (list vs map) or provider returns tags in different structures across calls. This nondeterminism causes spurious diffs. Using lifecycle.ignore_changes for tags is a stopgap that prevents recreation but can mask legitimate tag drifts. A safer approach is to normalize tags to a consistent deterministic map in configuration and ensure consistent provider versions and stateless CI runner environments.

Possible causes

AWS provider returning tags in non-deterministic ordering/structure (list vs map) across calls leading Terraform to detect differences and plan replacement for certain resource types

80%

Mixing of tag representation in config/state (some resources defined with tag map, others with tag lists or tags_on_create) causing diffs during refresh

50%

Corrupted or manually edited tfstate leading to mismatched attribute ordering recorded in state vs current provider response

25%

Suggested fixes

1

Diagnostic step 1

Normalize tags in Terraform configs to a stable map structure before applying: e.g., use locals and 'merge' to produce a consistent map: locals { common_tags = { Environment = var.env, Owner = var.owner } }. Replace any list-style tag uses with maps. This is reversible as it’s a code change.

2

Diagnostic step 2

Pin both Terraform and provider plugin versions in required_providers and your CI environment to the same exact versions used during successful applies. Re-run 'terraform init -upgrade' in a controlled CI run to ensure provider plugin consistency.

3

Diagnostic step 3

Use 'terraform refresh' and 'terraform plan -refresh-only' to see whether diffs are from provider responses. If tfstate looks corrupted or was edited, restore from a recent state backup. Avoid manual tfstate edits; use 'terraform state' commands if needed.

4

Diagnostic step 4

As a targeted mitigation, use 'lifecycle { ignore_changes = [tags] }' on resources where tags change frequently and are not business-critical. Document this plainly — this prevents spurious recreation but can hide legitimate tag drift. Prefer normalizing tags first.

5

Diagnostic step 5

If normalization and pinning do not remove spurious replacements, collect debug logs and open an issue with the provider maintainers (include 'TF_LOG=DEBUG' outputs) or escalate within your platform team; do not apply rolling recreations in production until root cause is confirmed.