3.3.3. terraform destroy

💡 First Principle: destroy is just apply driving the diff toward an empty desired state — it computes the reverse-dependency order and removes managed resources — which is why it's predictable and why it only touches what Terraform manages.

terraform destroy removes all infrastructure managed by the current configuration and state. It's effectively an alias for terraform apply -destroy: it generates a destruction plan, prompts for confirmation, and tears resources down in the correct reverse-dependency order (dependents before dependencies). Like apply, it then updates state to reflect the removals.

To remove only specific resources, use terraform destroy -target=aws_instance.web. For one-off removals of a single resource you more often just delete its block from configuration and apply — which destroys it as part of normal reconciliation.

⚠️ Exam Trap: destroy only affects resources Terraform manages in its state — it won't touch resources created outside Terraform or in other state files. Also note it asks for confirmation just like apply (and -auto-approve skips it). Don't assume destroy wipes an entire cloud account; it's scoped to managed resources.

Reflection Question: Why does destroy remove resources in the reverse of the order apply creates them?