Terraform google provider refuses destroy: deletion_protection defaults

TL;DR

Set deletionprotection = false on the resource in config. 2. terraform apply to record the change. 3. terraform destroy (or remove the resource) now proceeds. Do not set deletionprotection = false across the whole config "to make destroy work".

When to use

You are seeing this: Meaning: the resource was created with deletionprotection = true (the default for things like Cloud SQL instances). Use this skill when you run into "Terraform google provider refuses destroy: deletionprotection defaults".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Steps

1. Meaning: the resource was created with deletion_protection = true (the default for things like Cloud SQL instances). Terraform will not destroy it until you explicitly lower the guard.
2. Fix:
3. Set deletion_protection = false on the resource in config.
4. terraform apply to record the change.
5. terraform destroy (or remove the resource) now proceeds.
6. Do not set deletion_protection = false across the whole config "to make destroy work". The protection exists so a wrong workspace or a typo does not nuke production data. Flip it per resource, destroy, and consider flipping it back if the resource is recreated.
7. Agent traps:

• Destroying a whole environment in CI and hitting this on the database: expected. Handle it as a deliberate step, not an error to route around.
• The state file still lists the resource after a failed destroy. Do not hand-edit state to remove it; fix the config and re-run.
• Some resources have additional guards (like bucket force_destroy for non-empty buckets). Read the specific resource's docs; each guard has its own flag.

5. Verify: terraform plan -destroy shows the resource planned for destruction with no protection error before you approve the real destroy.

Verified 2026-09-26 on the google provider docs: deletion_protection is documented on protected resources (e.g. Cloud SQL) with destroy blocked until disabled. This is provider-documented safety behavior.