Controlled Resource Teardown

Beginner8 min

Safely destroy Terraform-managed resources with targeted destroys, plan previews, and protection mechanisms.

Prerequisites

-Terraform installed

Steps

Preview what will be destroyed

Generate a destroy plan to see exactly which resources will be removed before executing anything.

$ terraform plan -destroy

Always review the destroy plan. Terraform shows every resource that will be deleted.

Save the destroy plan to a file

Save the destroy plan so the exact reviewed changes are applied, nothing more or less.

$ terraform plan -destroy -out=destroy.tfplan

Destroy a specific resource only

Target a single resource for destruction instead of tearing down everything.

$ terraform destroy -target=aws_instance.temp_server

Targeted destroys can leave orphaned dependent resources. Always check for dependencies first.

Protect critical resources with lifecycle rules

Add prevent_destroy to resources that should never be accidentally deleted.

$ cat <<'EOF' >> main.tf resource "aws_rds_instance" "production" { # ... config ... lifecycle { prevent_destroy = true } } EOF

With prevent_destroy = true, Terraform will error if any plan attempts to delete this resource.

Execute the destroy plan

Apply the saved destroy plan after thorough review and team confirmation.

$ terraform apply destroy.tfplan

This is irreversible for most resources. Ensure backups exist for databases and persistent storage before proceeding.

Full Script

full-script.sh

#!/bin/bash
set -euo pipefail

# Safe Terraform Destroy Workflow

TARGET="${1:-}"

echo "==> Current resources in state:"
terraform state list

if [ -n "$TARGET" ]; then
  echo ""
  echo "==> Planning targeted destroy: ${TARGET}"
  terraform plan -destroy -target="$TARGET" -out=destroy.tfplan
else
  echo ""
  echo "==> Planning FULL destroy..."
  terraform plan -destroy -out=destroy.tfplan
fi

echo ""
RESOURCE_COUNT=$(terraform show -no-color destroy.tfplan | grep -c "will be destroyed" || echo "0")
echo "Resources to destroy: ${RESOURCE_COUNT}"

echo ""
read -p "Type 'destroy' to confirm: " CONFIRM
if [ "$CONFIRM" = "destroy" ]; then
  echo "==> Executing destroy..."
  terraform apply destroy.tfplan
  echo "==> Destroy complete."
else
  echo "==> Destroy cancelled."
  rm -f destroy.tfplan
fi

FAQ

Discussion

Loading comments...

#!/bin/bash set -euo pipefail # Safe Terraform Destroy Workflow TARGET="${1:-}" echo "==> Current resources in state:" terraform state list if [ -n "$TARGET" ]; then echo "" echo "==> Planning targeted destroy: ${TARGET}" terraform plan -destroy -target="$TARGET" -out=destroy.tfplan else echo "" echo "==> Planning FULL destroy..." terraform plan -destroy -out=destroy.tfplan fi echo "" RESOURCE_COUNT=$(terraform show -no-color destroy.tfplan | grep -c "will be destroyed" || echo "0") echo "Resources to destroy: ${RESOURCE_COUNT}" echo "" read -p "Type 'destroy' to confirm: " CONFIRM if [ "$CONFIRM" = "destroy" ]; then echo "==> Executing destroy..." terraform apply destroy.tfplan echo "==> Destroy complete." else echo "==> Destroy cancelled." rm -f destroy.tfplan fi