amadan
infra/region-host: never let a floating AMI replace a live host (#38)
The module's data.aws_ami is most_recent=true, so any newer Debian image turns a consumer's routine `tofu apply` into "replace the region host" — seen live 2026-08-03, when a plan in tito's deployment wanted to destroy carlos-tito-ie (the production fleet box) purely because Debian published a fresh AMI. ignore_changes=[ami] makes AMI updates explicit-replace territory instead. Claude-Session: https://claude.ai/code/session_01Q8o9diPhhDcQjErkvRCWVZ
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+9
−0
infra/modules/region-host/main.tf+9 −0
diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf| index 712fa8bc2..cee383b1b 100644 |
| --- a/infra/modules/region-host/main.tf |
| +++ b/infra/modules/region-host/main.tf |
| @@ -122,6 +122,15 @@ resource "aws_instance" "host" { |
| encrypted = true |
| } |
| tags = { Name = var.name } |
| + # The AMI data source floats (most_recent): without this, a newer |
| + # Debian image silently turns any consumer's `tofu apply` into |
| + # "replace the region host" — seen live 2026-08-03, when a routine |
| + # plan in tito's deployment wanted to destroy the production box. |
| + # AMI updates are explicit-replace territory: |
| + # `tofu apply -replace=module.<host>.aws_instance.host` when intended. |
| + lifecycle { |
| + ignore_changes = [ami] |
| + } |
| } |
| resource "aws_eip" "host" { |