Terraform ignore_changes block on JSON-encoded attribute

Question

I'm currently trying to get CloudWatch logging and DMS configuration working smoothly in my module by ignoring certain attributes on replication_task_settings. Right now, I have a DMS replication task that looks like the following:

resource "aws_dms_replication_task" "main" {
  migration_type            = "full-load-and-cdc"
  replication_instance_arn  = var.replication_instance_arn
  replication_task_id       = "${var.environment}-${var.customer}-dms-replication-task-ongoing-main-${var.engine}"
  source_endpoint_arn       = var.source_endpoint_arn
  target_endpoint_arn       = var.target_endpoint_arn
  replication_task_settings = jsonencode(local.task_settings)
  table_mappings            = jsonencode(local.table_mappings)
  tags                      = merge({}, local.additional_labels)

  lifecycle {
    ignore_changes = [
      replication_task_settings
    ]
  }
}

With this configuration, I'm ignoring all future changes to replication_task_settings. What I would like to do is only ignore changes to only Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream (not all of the task settings) since DMS creates these for you and you can't change them. The problem is that the replication _task_settings is a JSON-encoded attribute. If I try to do ignore_changes = [replication_task_settings["Logging"]["CloudWatchLogStream"]], I get this error:

Error: Invalid index

  on modules/repl-ongoing/main.tf line 250, in resource "aws_dms_replication_task" "main":
 250:       replication_task_settings["Logging"]["CloudWatchLogStream"]

This value does not have any indices.

If I try to decode the JSON by doing: ignore_changes = [jsondecode(replication_task_settings)["Logging"]["CloudWatchLogStream"]], I get the following error:

Error: Invalid expression

  on modules/repl-ongoing/main.tf line 250, in resource "aws_dms_replication_task" "main":
 250:       jsondecode(replication_task_settings)["Logging"]["CloudWatchLogStream"]

A single static variable reference is required: only attribute access and
indexing with constant keys. No calculations, function calls, template
expressions, etc are allowed here.

Is there a way I can ignore changes to specific properties of JSON-encoded attributes? Or is there another workaround with DMS tasks that I have to go with?

Answer 1

Due to how that resource type is designed, from Terraform's standpoint replication_task_settings is just an opaque string and so Terraform can either detect that the string has changed (the default) or ignore changes to the string as a whole.

There is no way to ignore changes to only part of a string, because Terraform implements ignore_changes by taking the previous value of that argument instead of the new value. Terraform doesn't and can't know how to construct an new string that combines some characters from the old string and some characters from the new string, because it has no awareness of the meaning of that string.