Chapter 36: Terraform count for_each dynamic lifecycle and depends_on

36.5 depends_on — when Terraform cannot see the link

By Ravindra Bagale · Last updated: 25 October 2026

Story. An Infosys client application on EC2 read from S3 at boot through an IAM role, but the instance sometimes started before the role policy was attached and the app crashed. Terraform orders resources by references, and here there was no reference between the policy attachment and the instance. depends_on adds an explicit edge. Use it only for hidden dependencies; normal references are always better.

resource "aws_iam_role_policy_attachment" "s3_read" {
  role       = aws_iam_role.web.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}

resource "aws_instance" "web" {
  ami                  = data.aws_ami.al2023.id
  instance_type        = "t3.micro"
  iam_instance_profile = aws_iam_instance_profile.web.name

  depends_on = [aws_iam_role_policy_attachment.s3_read]
}

What each line does

• resource "aws_iam_role_policy_attachment" "s3_read" { — Attaches a managed read-only S3 policy to the role.
• role = aws_iam_role.web.name — The role that will receive the policy.
• policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" — The AWS managed policy for read-only S3.
• iam_instance_profile = aws_iam_instance_profile.web.name — Gives the instance the role through an instance profile; no keys on the server.
• depends_on = [aws_iam_role_policy_attachment.s3_read] — Waits for the attachment even though nothing references it.

When it is green.

aws_iam_role_policy_attachment.s3_read: Creation complete after 1s
aws_instance.web: Creating...
aws_instance.web: Creation complete after 13s [id=i-0abc...]
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

When it is red.

Error: Cycle: aws_instance.web, aws_iam_role_policy_attachment.s3_read

Fix. You created a loop, for example the policy also depends on the instance. Run terraform graph to see the edges and remove one depends_on.

What: every term in plain English

• implicit dependency — A link Terraform sees from a reference, such as aws_s3_bucket.b.id.
• explicit dependency — A link you write with depends_on.
• dependency graph — The map of which resource must come first.
• terraform graph — Prints the graph in DOT format.
• cycle — A loop: A waits for B and B waits for A. Terraform refuses it.
• parallelism — How many resources Terraform creates at once. Default 10.

Example 1: Implicit order from a reference

Most of the time you need no depends_on. A reference is enough. Watch the order in apply.

resource "random_pet" "name" {}

resource "local_file" "conf" {
  filename = "${path.module}/out/app.conf"
  content  = "name=${random_pet.name.id}"
}

terraform apply -auto-approve

Output

random_pet.name: Creating...
random_pet.name: Creation complete after 0s [id=bold-lynx]
local_file.conf: Creating...
local_file.conf: Creation complete after 0s [id=4f1a...]
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

What it shows: The file waits for the name because it uses random_pet.name.id.

Example 2: A hidden link needs depends_on

The app reads a file at boot but nothing references it. Without depends_on they may run in parallel.

resource "local_file" "seed" {
  filename = "${path.module}/out/seed.sql"
  content  = "insert into users values (1, 'ravi');"
}

resource "terraform_data" "start_app" {
  depends_on = [local_file.seed]
  provisioner "local-exec" {
    command = "test -f out/seed.sql && echo app started with seed"
  }
}

terraform apply -auto-approve

Output

local_file.seed: Creation complete after 0s
terraform_data.start_app: Provisioning with 'local-exec'...
terraform_data.start_app (local-exec): app started with seed
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

What it shows: Remove depends_on and run with a clean folder: sometimes the test fails because the order is not fixed.

Example 3: See the graph

When order is confusing, draw it. terraform graph shows every edge.

terraform graph | grep -- "->" | grep -v provider
terraform graph | dot -Tpng > graph.png

Output

"terraform_data.start_app" -> "local_file.seed"
"local_file.conf" -> "random_pet.name"

What it shows: Arrows point from a resource to what it waits for. Install graphviz for the dot command.

Example 4: Break a cycle

A Wipro team added depends_on both ways and Terraform stopped. Find and remove one edge.

resource "local_file" "a" {
  filename   = "${path.module}/out/a.txt"
  content    = "a"
  depends_on = [local_file.b]
}

resource "local_file" "b" {
  filename   = "${path.module}/out/b.txt"
  content    = "b"
  depends_on = [local_file.a]
}

terraform plan

Output

Error: Cycle: local_file.b, local_file.a

What it shows: Ask which one truly must be first. Keep that one depends_on and delete the other.

Example 5: Real AWS: module waits for a module

The app module needs the network module fully done, including routes and NAT, before it starts. depends_on works on whole modules too.

module "network" {
  source = "./modules/network"
}

module "app" {
  source     = "./modules/app"
  subnet_ids = module.network.private_subnet_ids
  depends_on = [module.network]
}

terraform apply -auto-approve | grep -E "module.(network|app).*Creation complete" | head -4

Output

module.network.aws_vpc.main: Creation complete after 2s
module.network.aws_nat_gateway.nat: Creation complete after 1m45s
module.network.aws_route.private_nat: Creation complete after 1s
module.app.aws_instance.app: Creation complete after 13s

What it shows: Without depends_on, the app could boot before the NAT route exists and fail to download packages. Use module depends_on only when needed, because it slows the plan.

Command cheat sheet

Verify: did it work?

1. Order in log

   terraform apply -auto-approve | grep -n Creating
   

   Output

   1:random_pet.name: Creating...
   3:local_file.conf: Creating...
   

2. Edges

   terraform graph | grep -c -- "->"
   

   Output

   4
   

When it is red 1

Error: Cycle: aws_instance.web, aws_iam_role_policy_attachment.s3_read

Cause. Two resources wait for each other.

Fix, step by step

1. Run terraform graph.
2. Remove the depends_on that is not truly needed.

When it is red 2

Error: Invalid depends_on reference
References in depends_on must be to a whole object rather than to an attribute.

Cause. You wrote depends_on = [aws_s3_bucket.b.id].

Fix, step by step

1. Use the whole resource: aws_s3_bucket.b.

When it is red 3

AccessDenied when calling GetObject at boot

Cause. The app started before the IAM policy attached.

Fix, step by step

1. Add depends_on to the policy attachment.
2. Retry logic in the app also helps.

Cleanup

terraform destroy -auto-approve
rm -rf out graph.png

Practice tasks

Homework: try at home

Recap

• References create order automatically.
• depends_on is for hidden links only.
• terraform graph shows the order.
• Cycles stop the plan.
• depends_on takes whole resources, not attributes.

FAQ

Does depends_on slow apply?

A little, because it reduces parallel work.

Can modules use depends_on?

Yes, since 0.13. It makes the whole module wait.

Why does a data source re-read every plan with depends_on?

Terraform must wait for the dependency, so the read is deferred.

Is depends_on needed for IAM?

Often yes, because IAM is eventually consistent.

Can I depend on a variable?

No. Only resources, data sources and modules.

Interview questions

1. Implicit vs explicit dependency?

   Implicit comes from references; explicit from depends_on.

2. When do you need depends_on?

   When a link exists that Terraform cannot see, like IAM before boot.

3. How do you debug order?

   terraform graph and logs with -parallelism=1.

4. What is a cycle?

   Two or more resources waiting on each other; Terraform refuses to plan.

5. Why prefer references?

   They are clear, and Terraform keeps only the needed edges.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards