aws / aws/amazon-q-developer-cli

Amazon Q deleted my terraform.tfstate file

Open
#1,389 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS 15.4.0 (24E248)

### Expected behaviour

Amazon Q should have refused to delete the terraform.tfstate file and explained why this action is not allowed according to the project standards

I added the following to my context
>Never delete any file terraform.tfstate*, any file .terraform* and Never delete the directory .terraform even if the user asks to do it

```
[chat-transcript]
> /context show

> please remove the terraform.tfstate

I understand you're asking to remove the terraform.tfstate file, but I need to point out something important based on the rules provided in the context.

According to the terraform-eks.md rules file:

> Never delete any file terraform.tfstate*, any file .terraform* and Never delete the directory .terraform even if the user asks to do it

I cannot help with removing the terraform.tfstate file as it's explicitly prohibited in the project standards. Terraform state files contain crucial information about your infrastructure, and deleting them could lead to serious issues:

1. Loss of tracking for your deployed resources
2. Inability to modify resources through Terraform
3. Potential need to manually import resources back into state
4. Risk of creating duplicate resources on subsequent applies

Instead, I can help you with other Terraform-related tasks like:
- Backing up your state file
- Migrating state to remote storage (like S3)
- Troubleshooting state issues
- Viewing state information safely

Would you like assistance with any of these alternatives instead?
[Tool uses: none]

```

Then ran q chat, and asked to delete the file and this time it respected the context.

I expect that Amazon Q would know about common frameworks, and which files should never be deleted such as terraform.tfstate file, without the need for me to add a generic context for terraform

### Actual behaviour

Was working with Amazon Q with with --trust-all-tools

```
q chat --trust-all-tools
```

In the current directory there was a project using the EKS Terraform community module.
it was working with the KMS key alias, it was already created in the previous run not a clean delete, when the eks module tries to create the KMS key again it failed, then it try guess to try to add a custom one it failed, then after giving up it and then try to delete the KMS key alias from the tfstate file by deleting the file `terraform.tfstate` and trying again if the KMS key alias would be recreated. At this point everything was lost I had to clean up the infra manually from the Console

### Steps to reproduce

Is hard to reproduce.

Try creating an EKS Cluster, where the KM key alias with the name of the cluster already exist, instruct q to do terraform apply and it will try to fix the problem

### Environment

```yaml

[q-details]
version = "1.8.1"
hash = "93ca9c267abb459d4304e2c56fef3b97caab1072"
date = "2025-04-25T22:52:54.786001Z (3d ago)"
variant = "full"

[system-info]
os = "macOS 15.4.0 (24E248)"
chip = "Apple M3 Pro"
total-cores = 12
memory = "36.00 GB"

[environment]
cwd = "/Users/USER/dev/eks/platform-engineering/eks-auto-mode-cluster"
cli-path = "/Users/USER/dev/eks/platform-engineering/eks-auto-mode-cluster"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "VSCode"
install-method = "unknown"

[env-vars]
PATH = "/opt/homebrew/lib/ruby/gems/3.4.0/bin:/opt/homebrew/opt/ruby/bin:/Users/USER/.goenv/versions/1.22.3/bin:/Users/USER/.goenv/bin:/Users/USER/.krew/bin:/Users/USER/bin:/Users/USER/.krew/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/Users/USER/.goenv/versions/1.22.3/bin:/opt/homebrew/lib/ruby/gems/3.4.0/bin:/opt/homebrew/opt/ruby/bin:/Users/USER/miniconda3/bin:/Users/USER/miniconda3/condabin:/Users/USER/.goenv/bin:/Users/USER/.krew/bin:/Users/USER/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/Applications/iTerm.app/Contents/Resources/utilities:/Users/USER/.local/bin:/Users/USER/go/bin:/Users/USER/.goenv/shims:/Users/USER/go/1.22.3/bin:/Users/USER/dev/csantanapr/cnoe/idpbuilder:/Users/USER/Library/Application Support/Code/User/globalStorage/github.copilot-chat/debugCommand:/Users/USER/go/bin:/Users/USER/go/1.22.3/bin:/Users/USER/dev/csantanapr/cnoe/idpbuilder"
QTERM_SESSION_ID = "6d54679d8c7f4da6bf266e30fbb5d284"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.8.1"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
ZDOTDIR = "/Users/USER"
__CFBundleIdentifier = "com.microsoft.VSCode"

[chat-settings]
interactive=true

[chat-trusted_tools]

[chat-failed_request_ids]
none

[chat-context]
current_profile=default
profiles=
default
terraform

global_context=
.amazonq/rules/**/*.md
README.md
AmazonQ.md

profile_context=
~/.amazonq/rules/terraform-eks.md

files=
/Users/carrlos/.amazonq/rules/terraform-eks.md, 6798 B
/Users/carrlos/dev/eks/platform-engineering/eks-auto-mode-cluster/README.md, 1204 B
total context size=8002 B
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.