Q: In Terraform, you have accidentally deleted an RDS instance definition from your `main.tf` file and hit `apply`. Terraform is now attempting to destroy the production database. How do you architect Terraform files to protect against catastrophic accidental deletions?

While strict code reviews and IAM Deny policies are essential, Terraform has an explicit safety net for this exact scenario. You should use the Terraform lifecycle block on any stateful, catastrophic-to-lose resources (like RDS, S3 buckets, DynamoDB tables). If a developer deletes this block or attempts to run terraform destroy, Terraform will parse the state file, observe the prevent_destroy metadata still attached to that resource, and flat-out refuse to execute the plan, throwing an error and saving the database.

resource "aws_db_instance" "production" {
  # ... configuration ...
  lifecycle {
    prevent_destroy = true
  }
}