How does terraform destroy work and how do you prevent accidental destruction?
See how terraform destroy deletes resources in reverse dependency order and how prevent_destroy, plan review, and approvals stop accidental infrastructure loss.
Expected Interview Answer
terraform destroy reads the current state, builds a dependency graph of every managed resource, and deletes them in reverse dependency order so children are removed before their parents. You prevent accidental destruction with lifecycle prevent_destroy, targeted plans, required approvals, and least-privilege permissions.
Destroy is effectively the inverse of apply: it produces a plan showing every resource to be deleted, and only after confirmation does it call the provider's delete APIs, walking the graph from dependents up to their dependencies. Because it can wipe an entire environment, safeguards matter: set lifecycle { prevent_destroy = true } on critical resources, always review the destroy plan, gate prod behind manual approval in CI, protect state so it cannot be tampered with, and give operators only the permissions they truly need. Cloud-side deletion protection on databases and stateful stores adds a final backstop.
- prevent_destroy blocks deletion of critical resources
- The destroy plan surfaces exactly what will be removed
- Reverse dependency order avoids orphaned resources
- Approvals and least privilege reduce human error
- Cloud deletion protection adds a final safety net
AI Mentor Explanation
terraform destroy is like dismantling the whole match setup in reverse of how it was built: stumps come out before the pitch is rolled up, players leave before the ground is locked. prevent_destroy is the groundskeeper's rule that the historic pavilion can never be torn down, and reviewing the plan is checking the demolition list before anyone swings a hammer.
Step-by-Step Explanation
Step 1
Read current state
Terraform loads state to know exactly which real resources it manages.
Step 2
Build the dependency graph
It computes the order of deletion so dependents are removed before the things they depend on.
Step 3
Produce a destroy plan
terraform plan -destroy (or terraform destroy) shows every resource marked for deletion for review.
Step 4
Confirm and delete
After you approve, Terraform calls provider delete APIs in reverse dependency order.
Step 5
Apply safeguards
Use prevent_destroy, targeted destroys, approvals, and cloud deletion protection to avoid mistakes.
What Interviewer Expects
- Explains destroy as the inverse of apply using the dependency graph
- Knows deletion happens in reverse dependency order
- Mentions reviewing the destroy plan before confirming
- Knows lifecycle prevent_destroy on critical resources
- Mentions approvals, least privilege, and cloud deletion protection
Common Mistakes
- Running terraform destroy without reviewing the plan
- Assuming destroy deletes resources in creation order
- Not protecting critical resources with prevent_destroy
- Using -target carelessly and orphaning dependencies
- Giving CI or operators broad delete permissions in prod
Best Answer (HR Friendly)
“terraform destroy tears down the infrastructure Terraform built, removing pieces in the safe reverse order and only after showing you a list to confirm. To avoid accidents you mark critical things as protected, require approvals before running it in production, and limit who has permission to delete.”
Code Example
resource "aws_db_instance" "prod" {
identifier = "prod-db"
deletion_protection = true
lifecycle {
prevent_destroy = true
}
}
# Preview everything that would be destroyed:
# terraform plan -destroy
# Destroy only one non-critical resource, after review:
# terraform destroy -target=aws_instance.scratchFollow-up Questions
- What happens if prevent_destroy is set on a resource you try to destroy?
- How does -target change what terraform destroy removes?
- Why does destroy delete in reverse dependency order?
- How would you require manual approval before a prod destroy in CI?
- How is terraform destroy different from removing a resource from config?
MCQ Practice
1. In what order does terraform destroy remove resources?
Destroy walks the dependency graph in reverse, deleting dependents before the resources they depend on.
2. Which setting blocks Terraform from destroying a specific resource?
prevent_destroy causes Terraform to error out rather than delete that resource, guarding critical infrastructure.
3. What is the safest first step before running terraform destroy in production?
Reviewing the destroy plan surfaces every resource slated for deletion so you can catch unintended removals.
Flash Cards
How does terraform destroy order deletions? — In reverse dependency order, removing dependents before the resources they depend on to avoid orphans.
How do you protect a critical resource? — Set lifecycle { prevent_destroy = true } and enable cloud-side deletion protection where available.
How do you preview a destroy? — Run terraform plan -destroy to see every resource that would be deleted before confirming.
How to limit accidental destroys in CI? — Require manual approval for prod applies and grant least-privilege delete permissions.