A team is handing an existing load balancer over to a separate networking team that manages it with its own tooling. The load balancer must keep running, but this configuration should stop managing it, and the change must go through the normal plan review in a pull request. What should they do?
Select an answer to reveal the explanation.
Short Explanation
You want to let go of the load balancer without knocking it over. A removed block with destroy = false is your signed handover form: the plan shows Terraform forgetting it, and nothing gets deleted. The trap is just deleting the block, which Terraform reads as 'destroy it'.
Full Explanation
A removed block tells Terraform to remove a resource from state. By default that also destroys the real object, so setting destroy = false in the block's lifecycle is what keeps the infrastructure running while ending Terraform's management of it. Because the removed block is configuration, the effect appears in a plan that reviewers can approve in the same pull request, which is why the documentation recommends it over terraform state rm, which changes state immediately with no preview. Deleting the resource block alone makes Terraform plan to destroy the object, because a resource still present in state but absent from configuration is something Terraform deletes. Running terraform state rm from a laptop does achieve the outcome, but it bypasses review, depends on the timing of the later merge, and leaves a window in which another run could plan a recreation. The prevent_destroy argument only lives on a resource block, so deleting the block deletes the protection with it, and even when present it makes a destroy plan fail rather than forgetting the object. Exam caveat: the from address cannot include an instance key for count or for_each resources, and any references to the removed resource's attributes must also be deleted. Operational check: run terraform plan and confirm it reports the object will no longer be managed and will not be destroyed.