Skip to content
Sarj Standards

IaC · security

require-prevent-destroy-on-irreplaceable

iac:require-prevent-destroy-on-irreplaceable

Bucket, secret, or artifact registry must use a supported literal provider-side deletion guard or lifecycle { prevent_destroy = true }.

Code
SARJ203
Default
error
Fix
none
Languages
iac

Why

Buckets, secrets, and registries contain state that is difficult or impossible to reconstruct after an accidental infrastructure destroy.

Fix

Use a supported literal provider deletion guard, or add lifecycle { prevent_destroy = true }.

Before / after

Executed by this rule’s unit tests.

Before

Irreplaceable bucket without a deletion guard

storage.tf · focus
resource "google_storage_bucket" "records" {
  name = "records"
}

After

Irreplaceable bucket protected at plan time

storage.tf · focus
resource "google_storage_bucket" "records" {
  name = "records"
  lifecycle {
    prevent_destroy = true
  }
}

Limits

  • Only the curated resource types and documented Google provider guards are recognized.
  • A literal force_destroy = true is treated as an explicit declaration that the resource is disposable.