A Terraform module manages a critical shared VPC network. To prevent accidental deletion of that google_compute_network resource by runs or operators, which Terraform construct is the correct and simplest way to protect it?

The lifecycle { preventdestroy = true } meta-argument is the correct and simplest Terraform construct to prevent accidental deletion of a googlecomputenetwork resource. When this is set, Terraform will throw an error if an apply operation attempts to destroy the resource, requiring manual intervention to remove the protection before deletion is possible. Setting deletionprotection = true is not a valid argument for googlecomputenetwork resources; it's typically used for resources like Compute Engine instances or disks. Using ignorechanges would prevent Terraform from making changes to the resource, but it would not prevent its destruction. Configuring a Cloud IAM lock is an out-of-band GCP-level protection, not a Terraform construct, and while effective, it's not the simplest Terraform-native solution for this specific problem.