Asking for force-destroy is not the same as receiving it.

01 · THE HAZARD

A flexible variable can become a destructive escape hatch.

Terraform’s S3 force_destroy setting allows a non-empty bucket to be deleted. That convenience can be useful in a disposable development environment and dangerous in a production data lake.

Exposing the same Boolean everywhere leaves production safety dependent on a variable file, a command-line override or a rushed operator. The configuration accepts the request, even when the environment should never permit the outcome.

02 · THE GUARDRAIL

Derive the effective setting from environment policy.

The module distinguishes the requested value from the value resources actually receive. Development can honor the input, while production always resolves to false.

force_destroy_effective = (
  var.environment == "prod"
  ? false
  : var.force_destroy
)

The module also rejects unknown environments. That keeps a misspelled value from falling into a permissive default path.

03 · THE PROOF

Test the denied outcome, not only the happy path.

The strongest test deliberately supplies the dangerous combination: production plus force_destroy = true. A mocked provider allows Terraform to plan without AWS credentials, and the assertion verifies that the effective output is still false.

run "prod_refuses_force_destroy_even_when_asked" {
  command = plan

  variables {
    environment   = "prod"
    force_destroy = true
  }

  assert {
    condition = output.force_destroy_effective == false
  }
}