Terraform ignore_changes block on JSON-encoded attribute

I'm currently trying to get CloudWatch logging and DMS configuration working smoothly in my module by ignoring certain attributes on replication_task_settings. Right now, I have a DMS replication task that looks like the following:

resource "aws_dms_replication_task" "main" {
  migration_type            = "full-load-and-cdc"
  replication_instance_arn  = var.replication_instance_arn
  replication_task_id       = "${var.environment}-${var.customer}-dms-replication-task-ongoing-main-${var.engine}"
  source_endpoint_arn       = var.source_endpoint_arn
  target_endpoint_arn       = var.target_endpoint_arn
  replication_task_settings = jsonencode(local.task_settings)
  table_mappings            = jsonencode(local.table_mappings)
  tags                      = merge({}, local.additional_labels)

  lifecycle {
    ignore_changes = [
      replication_task_settings
    ]
  }
}

With this configuration, I'm ignoring all future changes to replication_task_settings. What I would like to do is only ignore changes to only Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream (not all of the task settings) since DMS creates these for you and you can't change them. The problem is that the replication _task_settings is a JSON-encoded attribute. If I try to do ignore_changes = [replication_task_settings["Logging"]["CloudWatchLogStream"]], I get this error:

Error: Invalid index

  on modules/repl-ongoing/main.tf line 250, in resource "aws_dms_replication_task" "main":
 250:       replication_task_settings["Logging"]["CloudWatchLogStream"]

This value does not have any indices.

If I try to decode the JSON by doing: ignore_changes = [jsondecode(replication_task_settings)["Logging"]["CloudWatchLogStream"]], I get the following error:

```
Error: Invalid expression

on modules/repl-ongoing/main.tf line 250, in resource "aws_dms_replication_task" "main":
250: jsondecode(replication_task_settings)["Logging"]["CloudWatchLogStream"]

A single sta

Due to how that resource type is designed, from Terraform's standpoint replication_task_settings is just an opaque string and so Terraform can either detect that the string has changed (the default) or ignore changes to the string as a whole.

There is no way to ignore changes to only part of a string, because Terraform implements ignore_changes by taking the previous value of that argument instead of the new value. Terraform doesn't and can't know how to construct an new string that combines some characters from the old string and some characters from the new string, because it has no awareness of the meaning of that string.

StackExchange DevOps Q#12947, answer score: 3