Stateful resource has no prevent-destroy guard

What it checks

Stateful resource has no prevent-destroy guard

Where it applies

Terraform: aws_db_instance, aws_rds_cluster, aws_s3_bucket, aws_dynamodb_table, aws_cognito_user_pool

CloudFormation: AWS::Cognito::UserPool, AWS::DynamoDB::Table, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::S3::Bucket

How to fix it

1. Add lifecycle { prevent_destroy = true } to the resource. Terraform then rejects any plan that would destroy it while the block stays in the configuration. Removing the resource block removes this setting with it, so it does not protect against deleting the block.

Frameworks

• AWS Well-Architected OPS.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules