I have a Terraform file that I want to prevent anyone from ever running terraform destroy on.

The normal way to do this would be to include the lifecycle block containing prevent_destroy = true on one or more resources in the file. But, I cannot do this. The file contains only modules, which do not accept lifecycle.

I considered modifying the modules themselves to contain a lifecycle block that could be configured with an argument. But that won’t work either because the block accepts only literal values, not variables.

Another alternative would be to add a do-nothing resource to the file that would accept the lifecycle block. It dosen’t much matter what resource this is, I guess? Any resource containing the block with prevent_destroy set should be enough to halt the destroy command. Right?

So, what’s the most economical resource type for me to use to do nothing but hold this block? Ideally, one that dosen’t incur additional cloud provider costs or security exposure.

The provider is Cloud Foundry. Terraform version is 1.7.5.