How to fix Error: keepers value has changed in Terraform

Examine the keepers block in your random resource configuration. Keepers should only reference values that exist before Terraform starts the apply phase and won't change afterward.

Good example—reference a pre-existing input variable:

resource "random_id" "instance" {
  keepers = {
    ami_id = var.ami_id  # Input variable, stable across plan/apply
  }
  byte_length = 8
}

Bad example—reference a computed resource attribute:

resource "random_id" "instance" {
  keepers = {
    file_hash = filemd5("./config.txt")  # May differ between plan and apply
  }
  byte_length = 8
}

Identify any keepers that reference computed outputs, file operations, or attributes of resources created in the same run.

Replace any computed keeper values with stable references. If you need to regenerate a random value based on a resource's attribute, use depends_on instead.

Replace file hashes with static content if possible:

# Bad: file hash changes during apply
keepers = {
  config_hash = filemd5("./config.txt")
}

# Better: reference a static input variable
keepers = {
  config_version = var.config_version
}

After editing keepers, run:

terraform plan

The plan should now show consistent keeper values without proposing replacement.

If the error persists, check for circular references where:
1. Random resource's keepers reference ResourceA
2. ResourceA depends on the random resource's output

This creates a cycle that Terraform can't resolve. Fix it by restructuring your configuration.

Example of a circular dependency:

# WRONG: Circular dependency
resource "random_id" "bucket_id" {
  keepers = {
    bucket_name = aws_s3_bucket.my_bucket.id  # Depends on S3 bucket
  }
}

resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-bucket-${random_id.bucket_id.hex}"  # Depends on random_id
}

Fix it by breaking the cycle:

# CORRECT: No circular dependency
resource "random_id" "bucket_id" {
  keepers = {
    prefix = var.bucket_prefix  # Reference input variable only
  }
  byte_length = 8
}

resource "aws_s3_bucket" "my_bucket" {
  bucket = "${var.bucket_prefix}-${random_id.bucket_id.hex}"
}

Re-run terraform plan to confirm the cycle is resolved.

If you need the random value to regenerate when another resource changes, use depends_on instead of adding that resource's attributes to keepers.

Good practice:

resource "random_id" "new_id" {
  keepers = {
    # Only reference stable values
    seed = var.regenerate_seed
  }
  depends_on = [
    aws_instance.app  # Ensures proper ordering
  ]
  byte_length = 8
}

This tells Terraform to respect the dependency without creating inconsistency in keeper values.

If you genuinely need a new random value, don't try to force it through changing keepers. Instead, use the replace option:

terraform apply -replace=random_id.bucket_id

This explicitly tells Terraform to destroy and recreate that resource, generating a new random value. This is safer and clearer than trying to manipulate keepers.

Alternatively, you can change a keeper variable manually:

terraform apply -var="regenerate_seed=2"

This changes the keeper value uniformly during apply, avoiding inconsistency errors.

This issue has been partially addressed in newer versions of Terraform and the random provider. Ensure you're running a recent version:

terraform version

Update to the latest Terraform and random provider:

terraform init -upgrade

Check your .terraform/versions or terraform.lock.hcl to see which version of the random provider you're using. Consider upgrading to the latest:

terraform {
  required_providers {
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"  # Use latest stable version
    }
  }
}

After upgrading, run terraform init and test again.