Prevent_destroy lifecycle rule in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the effect of prevent_destroy in this Terraform resource

Given the following Terraform resource configuration, what will happen if you try to run terraform destroy on this resource?

Terraform

resource "aws_s3_bucket" "example" {
  bucket = "my-unique-bucket-name"

  lifecycle {
    prevent_destroy = true
  }
}

A Terraform will destroy the bucket without any warnings.

B Terraform will refuse to destroy the bucket and show an error.

C Terraform will prompt for confirmation before destroying the bucket.

D Terraform will ignore the prevent_destroy rule and destroy the bucket.

💡 Hint

Think about what the prevent_destroy lifecycle rule is designed to do.

The prevent_destroy lifecycle rule tells Terraform to block any attempt to destroy the resource. This protects important resources from accidental deletion.

❓ service_behavior

intermediate

What happens if prevent_destroy is not set and you run terraform destroy?

Consider a Terraform resource without the prevent_destroy lifecycle rule. What is the expected behavior when running terraform destroy?

Terraform

resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
}

A Terraform will refuse to destroy the instance.

B Terraform will pause and ask for manual approval before destroying.

C Terraform will keep the instance running but remove it from state.

D Terraform will destroy the instance without any restrictions.

💡 Hint

What is the default behavior if no lifecycle rules are set?

Without prevent_destroy, Terraform will destroy resources normally when you run terraform destroy.

❓ Architecture

advanced

Choose the correct lifecycle block to protect a resource from accidental deletion but allow updates

You want to protect an AWS RDS instance from being destroyed accidentally but still allow updates to its configuration. Which lifecycle block achieves this?

A lifecycle { prevent_destroy = true }

B lifecycle { create_before_destroy = true }

C lifecycle { ignore_changes = ["*"] }

D lifecycle { prevent_destroy = false }

💡 Hint

Think about which lifecycle rule stops destruction but not updates.

The prevent_destroy rule blocks resource deletion but allows updates to other attributes.

❓ security

advanced

What security risk does prevent_destroy help mitigate in Terraform-managed infrastructure?

How does setting prevent_destroy = true in a Terraform resource lifecycle block improve security?

A It prevents accidental or malicious deletion of critical infrastructure.

B It encrypts the resource data at rest automatically.

C It restricts access to the resource to only authorized users.

D It automatically backs up the resource before any changes.

💡 Hint

Consider what kind of mistakes or attacks could cause resource loss.

prevent_destroy stops Terraform from deleting resources, protecting against accidental or malicious removal.

✅ Best Practice

expert

When should you NOT use prevent_destroy in Terraform lifecycle rules?

Which scenario is NOT a good reason to use prevent_destroy in a Terraform resource lifecycle block?

A When accidental deletion would cause downtime.

B When the resource holds critical production data.

C When the resource is temporary and should be destroyed regularly.

D When you want to protect infrastructure from accidental removal.

💡 Hint

Think about when destruction is expected or necessary.

Using prevent_destroy on temporary resources that need regular deletion can cause deployment issues.