Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions skills/terraform-skill/references/state-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -1797,9 +1797,9 @@ rm .terraform/terraform.tfstate.lock.info # ❌ Dangerous

A targeted destroy can cascade far beyond its targets via implicit dependencies. Always follow this sequence:

1. Run `terraform plan -destroy [-target=...]` never skip straight to destroy
1. Run `terraform plan -destroy [-target=...]` - never skip straight to destroy
2. Read **every** resource under "will be destroyed", not just the targeted ones
3. ⚠️ Watch for `for_each` resources fed by a local that references a targeted resource all instances become implicit dependents (e.g. targeting an `aws_eip` that is referenced in a `locals {}` block used by a `for_each` record resource will destroy **all** those records)
3. ⚠️ Watch for `for_each` resources fed by a local that references a targeted resource - all instances become implicit dependents (e.g. targeting an `aws_eip` that is referenced in a `locals {}` block used by a `for_each` record resource will destroy **all** those records)
4. Get explicit user confirmation of the full list before proceeding
5. ❌ Never use `-auto-approve` on destroy in production

Expand All @@ -1815,7 +1815,7 @@ Common model mistakes to correct before returning state-related recommendations:
- mixes prod and non-prod in the same backend key
- recommends workspace-only isolation as a substitute for backend-level IAM separation
- writes DynamoDB-lock configuration on Terraform 1.10+ instead of using `use_lockfile = true` on the S3 backend
- runs `terraform destroy -auto-approve` or skips `plan -destroy` before a targeted destroy missing implicit dependents pulled in via shared locals
- runs `terraform destroy -auto-approve` or skips `plan -destroy` before a targeted destroy - missing implicit dependents pulled in via shared locals
- reads via `terraform_remote_state` within a single team's stack instead of using module outputs (see [module-patterns.md](module-patterns.md#3-use-terraform_remote_state-sparingly--only-at-true-ownership-boundaries))
- omits the rollback/recovery note for destructive state operations

Expand Down
Loading