terraform destroy: what it tears down, -target scoping, and guardrails
terraform destroy is a critical-severity command AI coding agents run without human checkpoints. DestructGuard's default tier blocks the pattern at execution time and logs every approve-or-abort decision to a JSONL audit trail you can replay with IncidentScribe.
terraform destroy
Blast radius
Every resource in the active workspace's state: VPCs, subnets, EKS/GKE clusters, RDS/Cloud SQL instances, S3/GCS buckets, IAM roles + policies, Route53 records, secret backends, and any custom provider resources. With `--auto-approve` no confirmation prompt fires.
Scoping it: -target, prevent_destroy, and plan -destroy
`terraform plan -destroy` previews exactly what would be removed — always run it first. `terraform destroy -target=module.staging` limits the teardown to one address instead of the whole state. And `lifecycle { prevent_destroy = true }` on databases, state buckets, and KMS keys makes Terraform refuse to destroy them at plan time — the single cheapest guardrail against both agent mistakes and fat-fingered humans.
Why agents reach for it
Agents trigger it when asked to clean up dev environments, when recovering from a broken state file (`terraform plan` showing impossible-to-resolve diffs), or as the final step in a 'rebuild from scratch' sequence.
Recovery options
No native rollback. Stateful resources (databases, persistent disks) may have provider-side backups — RDS snapshots typically retained for the configured window, Cloud SQL backups per the cloud's policy. Stateless resources (load balancers, IAM roles, security groups) must be re-applied from the Terraform module after manually clearing state and re-importing surviving resources.
Real-world incident
A GitHub Copilot agent ran `terraform destroy --auto-approve` against a workspace it labeled 'dev' in the variables file — the workspace was actually production-shared-services. RDS snapshots restored databases; everything else took 9 hours to re-apply, and the IAM role IDs changed, breaking external integrations.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes terraform destroy by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.