Skip to content
Sarj Sarj Sarj Standards

require-prevent-destroy-on-irreplaceable

Warn when a curated durable-data container lacks a literal provider-side deletion guard or Terraform lifecycle destroy guard.

SARJ203 Rule source Tests Catalog JSON

Why

Buckets, secrets, and registries may hold durable state; unguarded deletion needs review when no authoritative recovery source exists.

Fix

Prefer a supported provider guard. Otherwise consider lifecycle { prevent_destroy = true }, which stops planned deletion only while the resource block remains, or suppress SARJ203 with a disposable rationale.

Examples

Before — flagged Force deletion is not a disposable-resource declaration
storage.tf
resource "google_storage_bucket" "records" {
  name          = "records"
  force_destroy = true
}
After — preferred Provider policy still blocks a force-enabled deletion
storage.tf
resource "google_storage_bucket" "records" {
  name            = "records"
  force_destroy   = true
  deletion_policy = "PREVENT"
}
Before — flagged Durable-data bucket without a deletion guard
storage.tf
resource "google_storage_bucket" "records" {
  name = "records"
}
After — preferred Durable-data bucket protected by provider policy
storage.tf
resource "google_storage_bucket" "records" {
  name            = "records"
  deletion_policy = "PREVENT"
}