{"record":{"id":"4416d6a984dc53d1","repo":"hashicorp/terraform","slug":"can-t-delete-default-state-4416d6","errorCode":null,"errorMessage":"can't delete default state","messagePattern":"can't delete default state","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/s3/backend_state.go","lineNumber":142,"sourceCode":"\t// not our key, so don't include it in our listing\n\tif parts[1] != b.keyName {\n\t\treturn \"\"\n\t}\n\n\treturn parts[0]\n}\n\nfunc (b *Backend) DeleteWorkspace(name string, _ bool) tfdiags.Diagnostics {\n\tvar diags tfdiags.Diagnostics\n\n\tlog := logger()\n\tlog = logWithOperation(log, operationBackendDeleteWorkspace)\n\tlog = log.With(\n\t\tlogKeyBackendWorkspace, name,\n\t)\n\n\tif name == backend.DefaultStateName || name == \"\" {\n\t\treturn diags.Append(fmt.Errorf(\"can't delete default state\"))\n\t}\n\n\tlog.Info(\"Deleting workspace\")\n\n\tclient, err := b.remoteClient(name)\n\tif err != nil {\n\t\treturn diags.Append(err)\n\t}\n\n\treturn diags.Append(client.Delete())\n}\n\n// get a remote client configured for this state\nfunc (b *Backend) remoteClient(name string) (*RemoteClient, error) {\n\tif name == \"\" {\n\t\treturn nil, errors.New(\"missing state name\")\n\t}\n","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/s3/backend_state.go#L124-L160","documentation":"Returned by Backend.DeleteWorkspace (s3/backend_state.go:142) when the requested workspace name equals backend.DefaultStateName (\"default\") or is empty. Identical guard to the Postgres backend: the default workspace is protected and cannot be removed.","triggerScenarios":"Running `terraform workspace delete default` or `\"\"`; programmatic DeleteWorkspace(\"default\"); bulk cleanup scripts iterating all workspaces without skipping default.","commonSituations":"Automation that deletes every returned workspace; migration scripts passing an empty name; tooling assuming all listed workspaces are deletable.","solutions":["Skip \"default\" and empty names in deletion loops.","To reset default's contents, destroy resources or rewrite state rather than deleting the workspace.","Validate the name before calling DeleteWorkspace."],"exampleFix":"// before\n// for _, ws := range backend.Workspaces() { backend.DeleteWorkspace(ws, false) }\n\n// after\n// for _, ws := range backend.Workspaces() {\n//   if ws == \"default\" || ws == \"\" { continue }\n//   backend.DeleteWorkspace(ws, false)\n// }","handlingStrategy":"validation","validationCode":"// Guard the protected name before deleting\n// if name == \"\" || name == backend.DefaultStateName { return errors.New(\"protected\") }\n// backend.DeleteWorkspace(name, false)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Filter \"default\" out of workspace-deletion loops.","Validate workspace names from user input before calling DeleteWorkspace.","Reset default state via destroy, not workspace deletion."],"tags":["s3","workspace","validation","guard"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}