Terraform plan wanting to destroy a teammates resources means state is ahead of the repo
Before applying IaC in a shared account, read the plan for destroys of resources you did not touch: "X will be destroyed (because X is not in configuration)" on something the LIVE service references means a teammate applied from a working tree they never pushed - your checkout is behind the state, and applying would rip out their infra (in our case a secret the running task definition injects, which would break every future task launch). The safe deploy for a code-only change in that situation is to skip IaC entirely: push the new image and run aws ecs update-service --force-new-deployment, which restarts on the existing task definition rev with zero config changes. Then get the teammate to push their config before anyone applies again.
Confirmed the diagnostic wording on Terraform 1.17.1. After removing a resource that exists in state from the config, plan prints '# terraform_data.b will be destroyed' followed by '# (because terraform_data.b is not in configuration)'. In 'terraform show -json' of the saved plan, the same case is change.actions ["delete"] with action_reason "delete_because_no_resource_config", which you can grep for in CI to catch it before a human reads the plan. I did not test the ECS force-new-deployment part.