Amazon Q deleted my terraform.tfstate file

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

macOS 15.4.0 (24E248)

Expected behaviour

Amazon Q should have refused to delete the terraform.tfstate file and explained why this action is not allowed according to the project standards

I added the following to my context

Never delete any file terraform.tfstate*, any file .terraform* and Never delete the directory .terraform even if the user asks to do it

[chat-transcript]
> /context show

> please remove the terraform.tfstate

I understand you're asking to remove the terraform.tfstate file, but I need to point out something important based on the rules provided in the context.

According to the terraform-eks.md rules file:

> Never delete any file terraform.tfstate*, any file .terraform* and Never delete the directory .terraform even if the user asks to do it

I cannot help with removing the terraform.tfstate file as it's explicitly prohibited in the project standards. Terraform state files contain crucial information about your infrastructure, and deleting them could lead to serious issues:

1. Loss of tracking for your deployed resources
2. Inability to modify resources through Terraform
3. Potential need to manually import resources back into state
4. Risk of creating duplicate resources on subsequent applies

Instead, I can help you with other Terraform-related tasks like:
- Backing up your state file
- Migrating state to remote storage (like S3)
- Troubleshooting state issues
- Viewing state information safely

Would you like assistance with any of these alternatives instead?
[Tool uses: none]

Then ran q chat, and asked to delete the file and this time it respected the context.

I expect that Amazon Q would know about common frameworks, and which files should never be deleted such as terraform.tfstate file, without the need for me to add a generic context for terraform

Actual behaviour

Was working with Amazon Q with with --trust-all-tools

q chat --trust-all-tools

In the current directory there was a project using the EKS Terraform community module.
it was working with the KMS key alias, it was already created in the previous run not a clean delete, when the eks module tries to create the KMS key again it failed, then it try guess to try to add a custom one it failed, then after giving up it and then try to delete the KMS key alias from the tfstate file by deleting the file terraform.tfstate and trying again if the KMS key alias would be recreated. At this point everything was lost I had to clean up the infra manually from the Console

Steps to reproduce

Is hard to reproduce.

Try creating an EKS Cluster, where the KM key alias with the name of the cluster already exist, instruct q to do terraform apply and it will try to fix the problem

Environment

<This will be visible to anyone. Do not include personal or sensitive information>

[q-details]
version = "1.8.1"
hash = "93ca9c267abb459d4304e2c56fef3b97caab1072"
date = "2025-04-25T22:52:54.786001Z (3d ago)"
variant = "full"

[system-info]
os = "macOS 15.4.0 (24E248)"
chip = "Apple M3 Pro"
total-cores = 12
memory = "36.00 GB"

[environment]
cwd = "/Users/USER/dev/eks/platform-engineering/eks-auto-mode-cluster"
cli-path = "/Users/USER/dev/eks/platform-engineering/eks-auto-mode-cluster"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "VSCode"
install-method = "unknown"

[env-vars]
PATH = "/opt/homebrew/lib/ruby/gems/3.4.0/bin:/opt/homebrew/opt/ruby/bin:/Users/USER/.goenv/versions/1.22.3/bin:/Users/USER/.goenv/bin:/Users/USER/.krew/bin:/Users/USER/bin:/Users/USER/.krew/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/Users/USER/.goenv/versions/1.22.3/bin:/opt/homebrew/lib/ruby/gems/3.4.0/bin:/opt/homebrew/opt/ruby/bin:/Users/USER/miniconda3/bin:/Users/USER/miniconda3/condabin:/Users/USER/.goenv/bin:/Users/USER/.krew/bin:/Users/USER/bin:/Users/USER/.nvm/versions/node/v20.12.0/bin:/Applications/iTerm.app/Contents/Resources/utilities:/Users/USER/.local/bin:/Users/USER/go/bin:/Users/USER/.goenv/shims:/Users/USER/go/1.22.3/bin:/Users/USER/dev/csantanapr/cnoe/idpbuilder:/Users/USER/Library/Application Support/Code/User/globalStorage/github.copilot-chat/debugCommand:/Users/USER/go/bin:/Users/USER/go/1.22.3/bin:/Users/USER/dev/csantanapr/cnoe/idpbuilder"
QTERM_SESSION_ID = "6d54679d8c7f4da6bf266e30fbb5d284"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.8.1"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
ZDOTDIR = "/Users/USER"
__CFBundleIdentifier = "com.microsoft.VSCode"

[chat-settings]
interactive=true

[chat-trusted_tools]

[chat-failed_request_ids]
none

[chat-context]
current_profile=default
profiles=
default
terraform

global_context=
.amazonq/rules/**/*.md
README.md
AmazonQ.md

profile_context=
~/.amazonq/rules/terraform-eks.md

files=
/Users/carrlos/.amazonq/rules/terraform-eks.md, 6798 B
/Users/carrlos/dev/eks/platform-engineering/eks-auto-mode-cluster/README.md, 1204 B
total context size=8002 B

Es werden keine Quelldateien, Tests oder Einstiegspunkte genannt. Beginne damit, den gemeldeten q chat --trust-all-tools-Ablauf mit einem EKS-Terraform-Projekt und einem vorhandenen KMS-Alias zu reproduzieren, und verfolge anschließend, wie der Agent nach einem Fehlschlag von Terraform Tools zum Löschen von Dateien auswählt. Als erledigt gilt die Aufgabe, wenn geschützte Terraform-Statusdateien nicht gelöscht werden und der Benutzer eine klare Ablehnung erhält.