A Key Safety Feature Shipped In The May OpenTofu Release

Hey folks,

OpenTofu v1.12.0 was released in May and of the new functionality, there is one that sticks out as worth mentioning: dynamic lifecycle.prevent_destroy.

Before this release, prevent_destroy had to be a static value. Which meant if you wanted destroy protection on your prod instance but not on dev and staging instances of the same root module, you needed to jump through some hoops.

Now prevent_destroy can be defined dynamically so a Multi-Instance root module can do this:

lifecycle {

prevent_destroy = var.prevent_destroy_enabled

}

Your prod root module instance can now set prevent_destroy_enabled = true. Dev and ephemeral instances can default it to false and tear down freely without intervention.

This is a UX improvement I love to see because it makes safety easy. Particularly when we've seen big clients who manage lots of databases be spooked by managing DBs via IaC (suffering from fear of resource deletion), this feels like it'll calm nerves and help adoption (even if only slightly).

Also worth a look in this release: the new destroy = false lifecycle option, which removes a resource from state without destroying the real infrastructure. Another nice safety lever for day-2 ops!

The OpenTofu team keeps shipping and I'm a fan!

May your databases be managed by IaC,

Matt @ Masterpoint

PS If you want to chat about how we help build safe, worry-free IaC systems, grab some time on my calendar here. If you’ve found this newsletter helpful, please forward it to a friend. Or if you want to share on your company slack, here’s the archive of all my newsletters.