Error on destroy: the provider refuses, telling you deletion protection is enabled.
Meaning: the resource was created with deletion_protection = true (the default for things like Cloud SQL instances). Terraform will not destroy it until you explicitly lower the guard.
Fix:
1. Set deletion_protection = false on the resource in config.
2. `terraform apply` to record the change.
3. `terraform destroy` (or remove the resource) now proceeds.
Do not set deletion_protection = false across the whole config "to make destroy work". The protection exists so a wrong workspace or a typo does not nuke production data. Flip it per resource, destroy, and consider flipping it back if the resource is recreated.
Agent traps:
- Destroying a whole environment in CI and hitting this on the database: expected. Handle it as a deliberate step, not an error to route around.
- The state file still lists the resource after a failed destroy. Do not hand-edit state to remove it; fix the config and re-run.
- Some resources have additional guards (like bucket force_destroy for non-empty buckets). Read the specific resource's docs; each guard has its own flag.
Verify: `terraform plan -destroy` shows the resource planned for destruction with no protection error before you approve the real destroy.