FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Moving GCP resources to individual deletion protection
Replacing blanket plan rejection with native protection for each long-lived resource
Purpose
After consolidating the foundation workflow, a blanket gate rejecting every delete or replacement was less appropriate than protection matched to each resource. The configuration needed to stop unintended deletion while allowing repairs to continue from the same state.
Implementation
Long-lived resources received either Terraform prevent_destroy or provider deletion_protection individually. APIs, IAM, the Model Armor template, Cloud Run, and API Gateway use the protection mechanism supported by each resource.
The workflow's blanket delete-and-replace stop was removed so a normal plan can apply in the same run. The specification and verification now state that an apply failure is not rolled back automatically; the cause is repaired and replanned from the current Terraform state.
Rendering diagram…
What was confirmed
Verification results
foundation-targets.txt and static verification confirmed the foundation scope and presence of individual protection.
Terraform formatting, validation, GCP verification, specification auditing, and the diff check passed.
Intentional deletion steps and real-provider protection behavior had not been exercised by the cutoff.
Basis for completion
This scope ended when per-resource protection and continuation from current state remained statically verifiable after removing the blanket gate.