After every update to a CDN distribution, the team must invalidate its cache. Today a local-exec provisioner calls a vendor CLI. Their provider, used with Terraform 1.14 or later, now offers an action that performs the invalidation. How should they wire it to run after each update without managing it as a resource?

Terraform 1.14 introduced action blocks for provider-defined operations that are not resources. An action is declared with action "TYPE" "LABEL" and a config block of provider arguments, and it can run in two ways: from a resource's lifecycle block through an action_trigger that lists lifecycle events such as after_create or after_update together with the actions to run, or on demand with terraform plan or apply -invoke followed by the action address. Actions do not affect resource state, which matches the goal of running the invalidation without managing it as an object. Modelling it as terraform_data creates a tracked resource, and triggers_replace only replaces that resource; it cannot call a provider API by itself. replace_triggered_by accepts managed resource references and causes replacement of the resource that contains it, so it neither accepts an action nor invokes one. Check blocks evaluate assertions and report warnings; they cannot trigger operations. Exam caveat: action types come from providers, so availability depends on the provider version, and what should happen to the apply when a triggered action fails should be decided before production use. Operational check: run terraform plan after changing the distribution and confirm the plan shows the action scheduled after the update, then use -invoke to test it in isolation.