Dependency Graph: DAG Generation & Implicit vs Explicit Dependencies

The Big Idea

How does Terraform know the exact order in which to create twenty cloud resources across three subnets and two regions? It does not read your files from top to bottom. Instead, it compiles your entire configuration into a Directed Acyclic Graph (DAG).

In this graph, every resource is a node, and every dependency is a directed edge pointing from dependent to prerequisite. Terraform traverses the graph in reverse topological order. Any nodes with zero unsatisfied dependencies are executed in parallel using a pool of worker threads (default: 10 parallel operations).

There are two types of dependencies: Implicit dependencies, created naturally whenever one resource references an attribute of another, and Explicit dependencies, defined using the depends_on meta-argument for out-of-band requirements like IAM permissions propagation.

Implicit vs Explicit Dependency Declaration

resource "aws_iam_role" "cluster_role" {
  name = "production-eks-cluster-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "eks.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.cluster_role.name
}

# Explicit dependency: EKS requires IAM policies to be actively attached
# before creation, even though the EKS resource only references role_arn.
resource "aws_eks_cluster" "main" {
  name     = "production-core-cluster"
  role_arn = aws_iam_role.cluster_role.arn # Implicit dependency

  vpc_config {
    subnet_ids = [aws_subnet.public_a.id, aws_subnet.public_b.id]
  }

  # Explicit dependency forces cluster to wait for IAM policy attachment
  depends_on = [
    aws_iam_role_policy_attachment.cluster_policy
  ]
}