Ignore Tag Changes

Adds ignore_changes = [tags, tags_all] to all resources. Prevents Terraform from reverting externally managed tags.

Why this rule exists

AWS tags are modified by many systems outside Terraform: AWS Config rules, Service Catalog, cost allocation tools, security scanners, and manual console edits. When Terraform detects a tag difference, it plans an update to revert the tag, even if the external change is intentional.

This creates a constant stream of noisy plan diffs. Teams using default_tags in the AWS provider are especially affected because tags_all includes the merged set of resource-level and provider-level tags.

Related Terraform and OpenTofu issues

Affected resources

What this rule does

Adds a lifecycle { ignore_changes = [...] } block to each matching resource. Terraform and OpenTofu will ignore external changes to the listed attributes on subsequent plans.

Ignored attributes: tags, tags_all

Before and after

Before (upstream module):

resource "aws_*" "this" {
  # ... resource configuration ...

  tags = var.tags
}

After (with Ignore Tag Changes applied):

resource "aws_*" "this" {
  # ... resource configuration ...

  tags = var.tags

  lifecycle {
    ignore_changes = [tags, tags_all]
  }
}

The only change is the rule transformation. All existing arguments, outputs, and module behavior remain identical.

Known limits

• Does not prevent tag changes from happening. External systems can still modify tags freely.
• Does not affect the initial tag values set when a resource is first created.
• Does not cover non-AWS resources or resources from other providers.
• The aws_* pattern matches on the resource type name, not on whether that type accepts tags. Terraform rejects an ignore_changes entry naming an attribute a resource does not have, so a module containing untaggable aws_ resources — aws_s3_bucket_versioning, aws_s3_bucket_policy, and most other sub-resource types — will fail terraform validate after this rule runs. Check the rule against a copy of your module before adopting it.
• Terraform reports tags_all in ignore_changes as a redundant element, because the provider computes it. The warning is harmless but appears on every taggable resource the rule touches.
• Only .tf and .tofu files are read. Modules written in JSON syntax (.tf.json, .tofu.json) are left untouched.
• Only the module's own directory and its first-level modules/* submodules are processed. Modules that this module calls by source URL are separate downloads and are handled on their own request.

Compliance framework support

This rule is not a compliance control. It supports these framework objectives as an operational safeguard:

Default configuration

These are the values the rule ships with. They are not settable from a module source URL: ?rules= carries rule names only, so a per-request enable uses exactly the defaults below. Your organization sets them per rule, in its Baseline or in a ruleset, from the Operational Rules page; see Baseline rules and rulesets.

How to enable

On a framework host, per request:

Add ?rules=lifecycle_ignore_tags to your HTTPS module source. Use the full namespaced id. A bare lifecycle_ignore_tags matches no rule: it is skipped server-side and your terraform init still succeeds, without the rule.

module "example" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=lifecycle_ignore_tags"
}

On your organization's host:

Add the rule to the organization's Baseline, which applies to every module served from the bare organization form <alias>.compliance.tf/<namespace>/<name>/<provider>, or to a named ruleset that one module selects with ?ruleset=<name> on the HTTPS form of that address. A project environment (<alias>.compliance.tf/<project>/<env>/<module>) serves the rules frozen in its bound snapshot instead: there the rule goes into the config draft and reaches the environment by promotion. On both organization forms ?rules= is refused with a 400 — including the subtractive - prefix — rather than dropped, so you cannot mistake an ignored override for an applied one. Change the configuration, not the URL. See Baseline rules and rulesets for the configuration flow, and registry resolution for how the address forms differ.

Failure modes