Every terraform plan shows in-place tag updates on dozens of resources, even immediately after a successful apply with no code changes. The shared tags local includes CreatedAt = timestamp(). What is causing the perpetual diff?
Select an answer to reveal the explanation.
Short Explanation
timestamp() is a clock, and a clock never shows the same time twice. Put it in a tag and every plan sees a new value to write. The trap is blaming locals or the lock file when the real culprit is a value that changes every time you look at it.
Full Explanation
Terraform's timestamp function returns the current time, and the documentation notes that its result changes on every evaluation, which is why using it directly in resource arguments is discouraged. Each plan therefore computes a CreatedAt value different from the one stored in state, and because the tag feeds every resource that uses the shared local, every one of them shows an update. The same pattern appears with uuid() and other non-deterministic functions. A missing lock file affects which provider version init selects; it does not cause attribute recomputation on each plan, and with the same provider version the comparison would still be stable. Tag values are not sensitive by default and Terraform compares sensitive values normally anyway; redaction affects display, not diffing. Locals indeed are not stored as separate entries in state, but the resource arguments they feed are, so Terraform compares the evaluated tag against the recorded attribute without needing the local itself. Exam caveat: for a creation timestamp that never changes, use a resource such as time_static from the time provider, or terraform_data, so the value is captured once and kept in state. Operational check: replace the function, apply once, and confirm the next plan reports no changes.