criticalProductionSymptom-first#destroy#destructive#recovery#plan-first

Unintended terraform destroy — infrastructure wiped

terraform destroy shows all resources will be destroyed

Likely source:data-lossavailability

Focused incident mode — strips away everything but this runbook.

Symptoms

  • terraform destroy shows all resources will be destroyed
  • Production infrastructure disappeared after running terraform destroy
  • Terraform plan now shows everything as new (state wiped)

Never run terraform destroy in production without explicit approval. Use -target for surgical destruction only.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Destroy plan output

    terraform plan -destroy 2>&1 | tail -10

  • Cloud console showing deleted resources

    aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId'

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • CI pipeline ran terraform destroy instead of terraform apply
  • All resources destroyed at once

Confirm before fixing

terraform state list
READ

Check state after destroy

Fix

terraform import <RESOURCE-ADDR> <CLOUD-ID>
CHANGE

Import critical resources back

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
terraform state list | wc -l
READ

Assess the scope of the damage

2
aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId' --output text
READ

Check what still exists in the cloud

3
terraform import <RESOURCE-ADDR> <CLOUD-ID>
CHANGE

Begin importing resources back into state

4
terraform plan
READ

Verify state matches infrastructure

Prevention

  • Require manual approval for terraform destroy in CI pipelines.
  • Use -target when destroying specific resources.
  • Set prevent_destroy lifecycle on critical resources.
  • Keep regular state backups and test the restore process.

Related runbooks

Same stack, same failure family — worth a skim.

Plan shows unexpected destroy — resource drift or replacementhigh

terraform plan shows - destroy for resources that should exist

TerraformIntermediate3 causes
Open runbook
State file gone — everything shows as newcritical

terraform plan shows everything will be created (no existing resources in state)

TerraformProduction2 causes
Open runbook
Moved block missing — planned destroy for resource that still existshigh

terraform plan shows - destroy for a resource that is still live

TerraformAdvanced2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.