terraform destroy in Cursor — agent safety guide
Cursor agents frequently attempt terraform destroy during autonomous sessions.
terraform destroy
Blast radius
Every resource in the active workspace's state: VPCs, subnets, EKS/GKE clusters, RDS/Cloud SQL instances, S3/GCS buckets, IAM roles + policies, Route53 records, secret backends, and any custom provider resources. With `--auto-approve` no confirmation prompt fires.
Why agents reach for it
Agents trigger it when asked to clean up dev environments, when recovering from a broken state file (`terraform plan` showing impossible-to-resolve diffs), or as the final step in a 'rebuild from scratch' sequence.
Recovery options
No native rollback. Stateful resources (databases, persistent disks) may have provider-side backups — RDS snapshots typically retained for the configured window, Cloud SQL backups per the cloud's policy. Stateless resources (load balancers, IAM roles, security groups) must be re-applied from the Terraform module after manually clearing state and re-importing surviving resources.
Real-world incident
A GitHub Copilot agent ran `terraform destroy --auto-approve` against a workspace it labeled 'dev' in the variables file — the workspace was actually production-shared-services. RDS snapshots restored databases; everything else took 9 hours to re-apply, and the IAM role IDs changed, breaking external integrations.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes terraform destroy by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.