🏗️ Terraform Error: 'Invalid ignore_changes' cannot ignore a required argument

Exact Error Message

╷
│ Error: Invalid ignore_changes wildcard
│
│   on main.tf line 14, in resource "aws_instance" "web":
│   14:     ignore_changes = ["all", tags]
│
│ The ignore_changes argument accepts either the keyword "all" as its
│ sole element, or a list of resource attribute references, but not both.
╵

You may also see a closely related variant when the referenced attribute does not exist on the resource:

│ Error: Invalid expression
│
│   on main.tf line 14, in resource "aws_instance" "web":
│   14:     ignore_changes = [tag]
│
│ A single static variable reference is required: only attribute names and
│ object keys are allowed here.

What It Means

The ignore_changes list inside a lifecycle block tells Terraform to stop tracking drift on specific attributes after a resource is created. Terraform validates this list at parse time: each element must be a bare reference to a top-level argument or a nested object key on this resource, and the special keyword all may only appear on its own.

The error fires when you mix all with named attributes, reference an attribute that the provider schema does not expose, misspell an argument, or try to ignore a computed-only (read-only) attribute that you never set. It is a configuration validation error, so it stops plan before any provider calls happen.

Common Causes

• Combining "all" with named attributes in the same list — only one form is allowed.
• A typo in the attribute name (tag instead of tags, user_data misspelled).
• Referencing a nested block attribute with the wrong path, e.g. ebs_block_device.volume_size instead of the correct nested key.
• Trying to ignore a required argument — the provider still needs a value, so ignoring it is meaningless and rejected.
• Quoting the attribute like a string (ignore_changes = ["tags"]) on newer providers that expect a bare reference.
• Copying a lifecycle block between resource types that do not share the attribute.

Diagnostic Commands

Validate the configuration to surface the exact line and reason:

terraform validate

Confirm which attributes the resource type actually supports by inspecting the provider schema:

terraform providers schema -json | jq '.provider_schemas[].resource_schemas."aws_instance".block.attributes | keys'

Check the current state to see what the attribute is really called and whether it is set:

terraform state show aws_instance.web

Run a plan to confirm the fix removes the error and produces the drift-suppression you expect:

terraform plan

Step-by-Step Resolution

1. Read the error’s line number and look at the offending ignore_changes list. Decide whether you meant to ignore everything or specific attributes.

2. If you want to ignore all attributes, use all alone and remove every other element:

lifecycle {
  ignore_changes = all
}

3. If you want to ignore specific attributes, list them as bare references (no quotes on modern Terraform) and drop all:

resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = "t3.micro"

  tags = {
    Name = "web"
  }

  lifecycle {
    ignore_changes = [tags, user_data]
  }
}

4. Fix any misspelled or non-existent attribute names by cross-checking against the schema output from the diagnostic step. For nested blocks, reference the block and key precisely, e.g. ignore_changes = [ebs_block_device] to ignore the whole block.

5. If you were trying to ignore a required argument, remove it from ignore_changes — you cannot ignore something the provider mandates. Instead, drive that value from a stable input variable so it does not drift.

6. Re-validate and plan:

terraform validate && terraform plan

7. Confirm the plan no longer proposes changes to the ignored attributes.

Prevention

• Prefer named attributes over ignore_changes = all; the wildcard hides real drift and makes state divergence dangerous.
• Use bare attribute references, not quoted strings, to stay compatible with current Terraform syntax.
• Verify attribute names against terraform providers schema -json before adding them.
• Keep lifecycle blocks resource-specific — do not copy them wholesale between different resource types.
• Reserve ignore_changes for values mutated out-of-band (autoscaling tags, externally managed desired_count), not for silencing legitimate diffs.

Related Errors

• Invalid expression — a malformed reference inside ignore_changes, usually a quoting or path mistake.
• Unsupported attribute — the referenced attribute genuinely does not exist on the resource.
• Argument is required — you removed a required argument that ignoring cannot substitute for.
• Objects have changed outside of Terraform — drift you may actually want to review rather than ignore.

Frequently Asked Questions

Can I combine all with specific attributes? No. all must be the sole element of the list. To ignore multiple named attributes, list only those attributes and omit all.

Why is my quoted attribute name rejected? Recent Terraform versions expect bare references (tags, not "tags") inside ignore_changes. Remove the quotes.

Can I ignore a required argument? No. Required arguments must always carry a value, so Terraform rejects ignoring them. Feed the value from a stable variable instead.

How do I ignore a nested block attribute? Reference the nested path with dots or ignore the whole block by its name; check the provider schema for the exact key. For more IaC patterns, browse the prompt library.

Is ignore_changes = all ever a good idea? Rarely — it suppresses all drift detection, so use it only for imported resources you never intend to manage again. See more Terraform guides.