Prevent_destroy lifecycle rule in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the effect of prevent_destroy in this Terraform resource

Given the following Terraform resource configuration, what will happen if you try to run terraform destroy on this resource?

Terraform

resource "aws_s3_bucket" "example" {
  bucket = "my-unique-bucket-name"

  lifecycle {
    prevent_destroy = true
  }
}

A Terraform will destroy the bucket without any warnings.

B Terraform will refuse to destroy the bucket and show an error.

C Terraform will prompt for confirmation before destroying the bucket.

D Terraform will ignore the prevent_destroy rule and destroy the bucket.

💡 Hint

Think about what the prevent_destroy lifecycle rule is designed to do.

The prevent_destroy lifecycle rule tells Terraform to block any attempt to destroy the resource. This protects important resources from accidental deletion.

❓ service_behavior

intermediate

What happens if prevent_destroy is not set and you run terraform destroy?

Consider a Terraform resource without the prevent_destroy lifecycle rule. What is the expected behavior when running terraform destroy?

Terraform

resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
}

A Terraform will refuse to destroy the instance.

B Terraform will pause and ask for manual approval before destroying.

C Terraform will keep the instance running but remove it from state.

D Terraform will destroy the instance without any restrictions.

💡 Hint

What is the default behavior if no lifecycle rules are set?

Without prevent_destroy, Terraform will destroy resources normally when you run terraform destroy.

❓ Architecture

advanced

Choose the correct lifecycle block to protect a resource from accidental deletion but allow updates

You want to protect an AWS RDS instance from being destroyed accidentally but still allow updates to its configuration. Which lifecycle block achieves this?

A lifecycle { prevent_destroy = true }

B lifecycle { create_before_destroy = true }

C lifecycle { ignore_changes = ["*"] }

D lifecycle { prevent_destroy = false }

💡 Hint

Think about which lifecycle rule stops destruction but not updates.

The prevent_destroy rule blocks resource deletion but allows updates to other attributes.

❓ security

advanced

What security risk does prevent_destroy help mitigate in Terraform-managed infrastructure?

How does setting prevent_destroy = true in a Terraform resource lifecycle block improve security?

A It prevents accidental or malicious deletion of critical infrastructure.

B It encrypts the resource data at rest automatically.

C It restricts access to the resource to only authorized users.

D It automatically backs up the resource before any changes.

💡 Hint

Consider what kind of mistakes or attacks could cause resource loss.

prevent_destroy stops Terraform from deleting resources, protecting against accidental or malicious removal.

✅ Best Practice

expert

When should you NOT use prevent_destroy in Terraform lifecycle rules?

Which scenario is NOT a good reason to use prevent_destroy in a Terraform resource lifecycle block?

A When accidental deletion would cause downtime.

B When the resource holds critical production data.

C When the resource is temporary and should be destroyed regularly.

D When you want to protect infrastructure from accidental removal.

💡 Hint

Think about when destruction is expected or necessary.

Using prevent_destroy on temporary resources that need regular deletion can cause deployment issues.

Practice

1. What does the prevent_destroy lifecycle rule do in Terraform?

easy

A. Stops accidental deletion of a resource

B. Automatically recreates a resource if deleted

C. Prevents updates to a resource

D. Locks the resource to prevent any changes

Solution

1. Step 1: Understand the purpose of prevent_destroy

   The prevent_destroy rule is designed to stop Terraform from deleting a resource accidentally.

2. Step 2: Compare with other lifecycle rules

   Unlike update prevention or locking, it specifically blocks deletion unless the rule is removed.

3. Final Answer:

   Stops accidental deletion of a resource -> Option A

4. Quick Check:

   prevent_destroy stops deletion = A [OK]

Hint: Remember: prevent_destroy means no accidental deletes [OK]

Common Mistakes:

• Thinking it prevents updates instead of deletion
• Confusing it with resource locking
• Assuming it recreates deleted resources automatically

2. Which is the correct way to set the prevent_destroy rule in a Terraform resource?

easy

A. resource { prevent_destroy = true }

B. prevent_destroy = true

C. lifecycle { prevent_destroy = true }

D. lifecycle { prevent_delete = true }

Solution

1. Step 1: Identify correct syntax for lifecycle block

   The prevent_destroy must be inside a lifecycle block within the resource.

2. Step 2: Check option correctness

   lifecycle { prevent_destroy = true } correctly places prevent_destroy = true inside lifecycle { }. Others are either missing the block or have wrong keywords.

3. Final Answer:

   lifecycle { prevent_destroy = true } -> Option C

4. Quick Check:

   Correct lifecycle syntax = C [OK]

Hint: Always put prevent_destroy inside lifecycle block [OK]

Common Mistakes:

• Placing prevent_destroy outside lifecycle block
• Using wrong keyword like prevent_delete
• Adding prevent_destroy directly under resource

3. Given this Terraform resource snippet, what happens if you run terraform destroy?

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
  lifecycle {
    prevent_destroy = true
  }
}

medium

A. Terraform will show an error and stop the destroy

B. Terraform will delete the S3 bucket without error

C. Terraform will ignore prevent_destroy and delete anyway

D. Terraform will update the bucket instead of deleting

Solution

1. Step 1: Understand prevent_destroy effect on destroy

   The prevent_destroy = true stops Terraform from deleting the resource during destroy.

2. Step 2: Predict Terraform behavior on destroy

   Terraform will detect the rule and raise an error, preventing the deletion.

3. Final Answer:

   Terraform will show an error and stop the destroy -> Option A

4. Quick Check:

   prevent_destroy blocks destroy = A [OK]

Hint: prevent_destroy causes destroy to error, not delete [OK]

Common Mistakes:

• Assuming resource deletes anyway
• Thinking it updates instead of blocking destroy
• Believing Terraform silently ignores the rule

4. You added prevent_destroy = true to a resource but now need to delete it. What is the correct way to fix the error during terraform destroy?

medium

A. Run terraform destroy with --force flag

B. Remove or comment out the prevent_destroy line and apply again

C. prevent_destroy = false

D. Delete the resource manually from the cloud console

Solution

1. Step 1: Understand how prevent_destroy blocks deletion

   The rule must be removed or disabled in Terraform code before deletion can proceed.

2. Step 2: Identify correct fix

   Removing or commenting out the line and applying changes allows Terraform to delete the resource safely.

3. Final Answer:

   Remove or comment out the prevent_destroy line and apply again -> Option B

4. Quick Check:

   Disable prevent_destroy before destroy = B [OK]

Hint: Disable prevent_destroy in code before deleting resource [OK]

Common Mistakes:

• Using unsupported --force flag
• Setting prevent_destroy directly under resource
• Deleting resource manually without Terraform sync

5. You have a Terraform resource with prevent_destroy = true. You want to replace this resource safely without downtime. Which approach is best?

hard

A. Temporarily remove prevent_destroy, apply destroy, then recreate resource

B. Manually delete resource in cloud console, then run terraform apply

C. Use terraform taint to mark resource for replacement without removing prevent_destroy

D. Set prevent_destroy to false and run terraform apply to replace resource

Solution

1. Step 1: Understand prevent_destroy blocks deletion

   Removing prevent_destroy allows deletion but risks downtime; manual deletion is unsafe.

2. Step 2: Disable prevent_destroy for safe replacement

   Setting prevent_destroy = false inside the lifecycle block disables the deletion block. Then terraform apply can replace the resource if config changes require recreation.

3. Step 3: Apply changes safely

   This triggers replacement using Terraform's logic (e.g., with create_before_destroy if set), avoiding manual steps.

4. Final Answer:

   Set prevent_destroy to false and run terraform apply to replace resource -> Option D

5. Quick Check:

   Set prevent_destroy = false allows replacement = C [OK]

Hint: Set prevent_destroy = false before terraform apply to replace [OK]

Common Mistakes:

• Using `terraform taint` without disabling prevent_destroy
• Manually deleting resource causing drift
• Running destroy separately, risking downtime