Use case · Cloud infrastructure

Turn cloud teardown into a deliberate decision

Require a review before cloud resources are permanently deleted, whether the delete comes from a CLI, an IaC destroy, or a DNS change.

Cloud cleanup is where an autocomplete or an agent hallucination costs the most. The catalog documents validated deletion matrices for AWS, Azure, and Google Cloud CLIs, infrastructure teardown through Terraform, OpenTofu, and Pulumi, and Route 53 DNS deletions — all with critical-severity review defaults.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • The job deletes objects inside a bucket rather than whole resources — the object-storage workflow covers that surface.
  • The change targets a Kubernetes cluster — the cluster-operations workflow covers cluster mutations.

Prerequisites

Before you start

  • Guard is installed on the machine where cloud commands run.
  • You know which clouds and IaC tools your workspace uses.

Steps

The workflow

  1. 1

    Review AWS resource deletion

    The AWS entry reviews a validated AWS CLI operation matrix for permanent resource deletion and service termination across identity, compute, data, delivery, and control-plane services (aws ec2 terminate-instances, aws rds delete-db-instance, and more).

    AWS command protectionTry this coverage Coverage details
  2. 2

    Review Azure resource deletion

    The Azure entry reviews a validated Azure CLI operation matrix for permanent resource deletion across subscription, identity, network, compute, application, data, messaging, observability, and AI resources.

    Azure command protectionTry this coverage Coverage details
  3. 3

    Review Google Cloud resource deletion

    The Google Cloud entry reviews a validated gcloud operation matrix for permanent resource deletion across stable and supported release tracks.

    Google Cloud command protectionTry this coverage Coverage details
  4. 4

    Review infrastructure-as-code destroy

    The infrastructure-as-code entry reviews teardown through Terraform, OpenTofu, and Pulumi — including destroy invocations such as tofu destroy and pulumi destroy.

    Infrastructure-as-code protectionTry this coverage Coverage details
  5. 5

    Review Route 53 DNS deletions

    The Amazon Route 53 entry reviews hosted-zone, record, health-check, traffic-policy, DNSSEC, and Resolver deletions — the changes most likely to take a domain offline silently.

    Amazon Route 53 command protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

Permanent deletion commands that match the validated matrices pause for review before executing. The catalog lists documented safe variants such as --help and -h, which stay outside these rules, and non-deletion cloud commands follow the workspace policy.

Limitations

What this workflow does not claim

  • The deletion matrices are validated lists — a service outside the matrix has no documented coverage.
  • Coverage is limited to the reviewed operations and the surrounding Guard policy, per the catalog’s stated limitations.

Coverage referenced

Extensions in this workflow