How to fix Error: Cycle error when removing a resource along with create_before_destroy in Terraform

Use Terraform's -target flag to explicitly handle the resource with create_before_destroy first, bypassing dependency analysis. This defers the destruction of dependent resources:

terraform apply -auto-approve -target='aws_launch_configuration.example' && terraform apply -auto-approve

This two-step approach:
1. First applies changes to the targeted resource
2. Then applies the full configuration with all dependencies resolved

This workaround is particularly effective for removing resources or updating their dependencies.

Review your Terraform configuration to see which resources have create_before_destroy = true. Resources that depend on a create_before_destroy resource may implicitly inherit this behavior.

Look for patterns like:

resource "aws_autoscaling_group" "example" {
  launch_configuration = aws_launch_configuration.example.id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_launch_configuration" "example" {
  # This implicitly gets create_before_destroy if ASG has it
}

The ASG's create_before_destroy propagates to the launch configuration, creating potential cycles.

Evaluate whether create_before_destroy = true is truly necessary for all resources in your configuration. Only use it when:
- The resource recreation causes downtime concerns
- The resource is part of an active service
- You absolutely need zero-downtime updates

For less critical resources or during development, disable it:

resource "aws_instance" "example" {
  # ... config ...

  lifecycle {
    create_before_destroy = false  # Explicitly disable if not needed
  }
}

Fewer create_before_destroy settings mean fewer dependency propagation issues.

If you're relying on implicit dependencies (resource references in arguments), consider using explicit depends_on to give Terraform more control over the dependency graph:

resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id
}

resource "aws_instance" "app" {
  vpc_security_group_ids = [aws_security_group.app.id]

  depends_on = [aws_security_group.app]

  lifecycle {
    create_before_destroy = true
  }
}

Explicit depends_on helps Terraform better understand the dependency direction.

As a last resort, you can manually edit the Terraform state file to add create_before_destroy to affected resources:

terraform state show aws_instance.example
terraform state edit

In the state file, locate the resource and add:

"create_before_destroy": true

Save the file. This tells Terraform to handle the resource correctly on the next apply.

Warning: Editing state directly is risky. Always backup your state file first:

terraform state pull > backup.tfstate

If create_before_destroy previously left deposed (old) resources in your state, refresh the state to clean them up:

terraform refresh

This re-queries your actual cloud resources and removes stale deposed state entries that may be causing cycle errors.

After refreshing, run plan again to see if the cycle error persists:

terraform plan