- Use `precondition` blocks inside `lifecycle` to validate variable values before apply: `condition = var.environment != "" error_message = "environment must not be empty"`.
- Use `postcondition` blocks to assert that created resource attributes meet expected contracts — catch API-returned values that violate assumptions.
- Set `prevent_destroy = true` in `lifecycle` for stateful resources (databases, S3 buckets) to prevent accidental destruction by plan changes.
- Use `ignore_changes` in `lifecycle` to suppress drift detection for attributes managed outside Terraform — document every `ignore_changes` entry with a comment explaining why.