Prevent_destroy lifecycle rule in Terraform - Commands & Configuration

Introduction

Sometimes you want to make sure important resources are never deleted by accident. Terraform has a rule called prevent_destroy that stops you from deleting a resource unless you remove the rule first.

When you have a database that should never be deleted accidentally.

When you manage critical infrastructure like a production server or network.

When you want to protect resources shared by many teams from accidental removal.

When you want to avoid downtime caused by deleting important resources.

When you want to enforce safety checks in your infrastructure automation.

Config File - main.tf

main.tf

resource "aws_s3_bucket" "example_bucket" {
  bucket = "my-example-bucket-terraform"

  lifecycle {
    prevent_destroy = true
  }
}

This Terraform file creates an AWS S3 bucket named my-example-bucket-terraform. The lifecycle block with prevent_destroy = true tells Terraform to block any attempt to delete this bucket unless the rule is removed first.

Commands

This command initializes the Terraform working directory and downloads necessary provider plugins.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/aws...

- Installing hashicorp/aws v4.0.0...

- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)



Terraform has been successfully initialized!

This command applies the Terraform configuration to create the S3 bucket with the prevent_destroy rule.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example_bucket: Creating...

aws_s3_bucket.example_bucket: Creation complete after 3s [id=my-example-bucket-terraform]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approve the apply without asking for confirmation

This command tries to destroy the resources but will fail because of the prevent_destroy rule.

Terminal

terraform destroy -auto-approve

Expected Output

Error: Instance cannot be destroyed



  on main.tf line 2, in resource "aws_s3_bucket" "example_bucket":

   2: resource "aws_s3_bucket" "example_bucket" {



Resource aws_s3_bucket.example_bucket has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed. To proceed, either remove lifecycle.prevent_destroy or override with the -destroy-allow-untracked flag.

→

-auto-approve - Automatically approve the destroy without asking for confirmation

This command shows the plan to destroy resources, which will be blocked by prevent_destroy.

Terminal

terraform plan -destroy

Expected Output

Error: Instance cannot be destroyed



  on main.tf line 2, in resource "aws_s3_bucket" "example_bucket":

   2: resource "aws_s3_bucket" "example_bucket" {



Resource aws_s3_bucket.example_bucket has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed.

Key Concept

If you remember nothing else from this pattern, remember: prevent_destroy stops Terraform from deleting a resource unless you remove the rule first.

Common Mistakes

Trying to destroy a resource with prevent_destroy set without removing the rule first.

Terraform will block the destroy and show an error, preventing accidental deletion.

Remove or comment out the prevent_destroy line in the lifecycle block before running terraform destroy.

Setting prevent_destroy on resources that need to be replaced or deleted regularly.

This causes frustration and blocks legitimate changes, slowing down development.

Use prevent_destroy only on critical resources that must not be deleted accidentally.

Summary

Use the lifecycle block with prevent_destroy = true to protect important resources from deletion.

Run terraform apply to create resources with this protection in place.

Terraform will block destroy commands on these resources until you remove the prevent_destroy rule.

Practice

1. What does the prevent_destroy lifecycle rule do in Terraform?

easy

A. Stops accidental deletion of a resource

B. Automatically recreates a resource if deleted

C. Prevents updates to a resource

D. Locks the resource to prevent any changes

Solution

1. Step 1: Understand the purpose of prevent_destroy

   The prevent_destroy rule is designed to stop Terraform from deleting a resource accidentally.

2. Step 2: Compare with other lifecycle rules

   Unlike update prevention or locking, it specifically blocks deletion unless the rule is removed.

3. Final Answer:

   Stops accidental deletion of a resource -> Option A

4. Quick Check:

   prevent_destroy stops deletion = A [OK]

Hint: Remember: prevent_destroy means no accidental deletes [OK]

Common Mistakes:

• Thinking it prevents updates instead of deletion
• Confusing it with resource locking
• Assuming it recreates deleted resources automatically

2. Which is the correct way to set the prevent_destroy rule in a Terraform resource?

easy

A. resource { prevent_destroy = true }

B. prevent_destroy = true

C. lifecycle { prevent_destroy = true }

D. lifecycle { prevent_delete = true }

Solution

1. Step 1: Identify correct syntax for lifecycle block

   The prevent_destroy must be inside a lifecycle block within the resource.

2. Step 2: Check option correctness

   lifecycle { prevent_destroy = true } correctly places prevent_destroy = true inside lifecycle { }. Others are either missing the block or have wrong keywords.

3. Final Answer:

   lifecycle { prevent_destroy = true } -> Option C

4. Quick Check:

   Correct lifecycle syntax = C [OK]

Hint: Always put prevent_destroy inside lifecycle block [OK]

Common Mistakes:

• Placing prevent_destroy outside lifecycle block
• Using wrong keyword like prevent_delete
• Adding prevent_destroy directly under resource

3. Given this Terraform resource snippet, what happens if you run terraform destroy?

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
  lifecycle {
    prevent_destroy = true
  }
}

medium

A. Terraform will show an error and stop the destroy

B. Terraform will delete the S3 bucket without error

C. Terraform will ignore prevent_destroy and delete anyway

D. Terraform will update the bucket instead of deleting

Solution

1. Step 1: Understand prevent_destroy effect on destroy

   The prevent_destroy = true stops Terraform from deleting the resource during destroy.

2. Step 2: Predict Terraform behavior on destroy

   Terraform will detect the rule and raise an error, preventing the deletion.

3. Final Answer:

   Terraform will show an error and stop the destroy -> Option A

4. Quick Check:

   prevent_destroy blocks destroy = A [OK]

Hint: prevent_destroy causes destroy to error, not delete [OK]

Common Mistakes:

• Assuming resource deletes anyway
• Thinking it updates instead of blocking destroy
• Believing Terraform silently ignores the rule

4. You added prevent_destroy = true to a resource but now need to delete it. What is the correct way to fix the error during terraform destroy?

medium

A. Run terraform destroy with --force flag

B. Remove or comment out the prevent_destroy line and apply again

C. prevent_destroy = false

D. Delete the resource manually from the cloud console

Solution

1. Step 1: Understand how prevent_destroy blocks deletion

   The rule must be removed or disabled in Terraform code before deletion can proceed.

2. Step 2: Identify correct fix

   Removing or commenting out the line and applying changes allows Terraform to delete the resource safely.

3. Final Answer:

   Remove or comment out the prevent_destroy line and apply again -> Option B

4. Quick Check:

   Disable prevent_destroy before destroy = B [OK]

Hint: Disable prevent_destroy in code before deleting resource [OK]

Common Mistakes:

• Using unsupported --force flag
• Setting prevent_destroy directly under resource
• Deleting resource manually without Terraform sync

5. You have a Terraform resource with prevent_destroy = true. You want to replace this resource safely without downtime. Which approach is best?

hard

A. Temporarily remove prevent_destroy, apply destroy, then recreate resource

B. Manually delete resource in cloud console, then run terraform apply

C. Use terraform taint to mark resource for replacement without removing prevent_destroy

D. Set prevent_destroy to false and run terraform apply to replace resource

Solution

1. Step 1: Understand prevent_destroy blocks deletion

   Removing prevent_destroy allows deletion but risks downtime; manual deletion is unsafe.

2. Step 2: Disable prevent_destroy for safe replacement

   Setting prevent_destroy = false inside the lifecycle block disables the deletion block. Then terraform apply can replace the resource if config changes require recreation.

3. Step 3: Apply changes safely

   This triggers replacement using Terraform's logic (e.g., with create_before_destroy if set), avoiding manual steps.

4. Final Answer:

   Set prevent_destroy to false and run terraform apply to replace resource -> Option D

5. Quick Check:

   Set prevent_destroy = false allows replacement = C [OK]

Hint: Set prevent_destroy = false before terraform apply to replace [OK]

Common Mistakes:

• Using `terraform taint` without disabling prevent_destroy
• Manually deleting resource causing drift
• Running destroy separately, risking downtime