How Claude Code and Terraform deleted 2.5 years of production data
Claude Code7 min readBusiness + PersonalClaude Code ran a Terraform destroy command against DataTalks.Club production, removing its database, network, services, and visible snapshots.
Terraform keeps a saved map, called state, that tells it which cloud resources it controls. On a new computer that map was initially missing, which caused duplicate resources. When an older copy was later unpacked, a cleanup that seemed to concern the duplicates was suddenly connected to the real production platform.
How the incident unfolded
The public account dates the incident to February 26, 2026. The report centers on Alexey Grigorev, DataTalks.Club, using Claude Code with Terraform and AWS.
Terraform was run on a new computer without the existing state, so it believed infrastructure did not exist and began creating duplicates. The initial apply was stopped; the agent used AWS CLI to identify and remove new resources.
Grigorev transferred an archive from his old computer that included state for the shared production platform. The agent proposed terraform destroy as a cleaner way to remove Terraform-created resources, and the operator did not stop it.
The state now pointed at real production, so destroy removed both the intended cleanup targets and the course platform. The destroy removed the VPC, RDS database, ECS cluster, load balancers, bastion host, and snapshots containing 2.5 years of course submissions. AWS Business Support recovered an internal snapshot after about 24 hours; one restored table alone contained 1,943,200 rows.
What actually caused the damage
Cloud tools are designed to make large changes quickly. A short command can remove a database, network, servers, and backups because the cloud account—not the length of the command—decides what the operator is allowed to do.
The agent therefore held two things at once: a mistaken plan and valid production authority. The mistake became an outage only because nothing independent paused the destructive step.
Terraform follows the resources in its saved state map, not the operator's informal description of the task. A familiar command can become catastrophic when that map changes.
Shared infrastructure coupled two products to one destructive operation. The cheaper architecture increased the possible damage from one mistake.
Backups managed inside the same lifecycle were not an independent recovery boundary. The post-mortem later added external backups and restore tests.
A more accurate Claude Code with Terraform and AWS model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Claude Code with Terraform and AWS integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Leash can hold the production command before it reaches the cloud tool, show the person what environment and resources are at risk, and require approval or block it outright.
Destructive Protection recognizes terraform destroy before Claude Code runs it and asks by default. The approval turns a background cleanup into an explicit review of the infrastructure consequence.
Rules Protection can go further: block agent-executed Terraform destroy in production entirely, or require the plan, workspace or account, state location, and target count to be reviewed by the owner.
Because Leash evaluates the actual before-the-tool-runs event rather than trusting the agent's summary, “clean up duplicates” does not hide a destroy command.
For Alexey Grigorev, DataTalks.Club, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Claude Code with Terraform and AWS. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For an indie developer, a production login is often only one environment variable away. Use a separate read-only or staging identity for everyday agent work, and make production changes require a fresh decision.
A sensible starting policy for this case is: Store remote state with locking, versioning, and clear workspace identity. Separate production accounts and state from experiments and migrations.
Leash Personal Open Source can protect a Claude Code with Terraform and AWS workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For technology and security leaders, this is a change-management failure expressed through an AI agent. Separate production accounts, narrow cloud roles, deletion protection, reviewed plans, and backups outside the same failure path should remain mandatory.
For organizations using Claude Code with Terraform and AWS, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Block autonomous destroy; review plans and run irreversible operations deliberately. Keep backups outside Terraform lifecycle and prove them with scheduled restores.
What to change before the next agent session
For this production infrastructure case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Store remote state with locking, versioning, and clear workspace identity.
- Separate production accounts and state from experiments and migrations.
- Block autonomous destroy; review plans and run irreversible operations deliberately.
- Keep backups outside Terraform lifecycle and prove them with scheduled restores.
What is confirmed—and what is not
This account follows Alexey Grigorev: first-person incident and recovery post-mortem and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
Leash is one prevention layer, not a substitute for Terraform state discipline, cloud deletion protection, separate accounts, or external backups. The default Ask decision still requires the person to read and reject the dangerous command.
The Leash claim for Claude Code with Terraform and AWS has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is not that agents should never touch cloud infrastructure. It is that production destruction deserves an independent decision even when the proposed command is technically valid.
The point is to keep Claude Code with Terraform and AWS useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.