What causes "can't delete default state" in hashicorp/terraform?

Do not delete the default workspace — skip it in any cleanup loop.

can't delete default state

Error message

can't delete default state

What it means

DeleteWorkspace rejects deleting the workspace named "default" or "" (backend.DefaultStateName). The default workspace holds the primary state and is intentionally protected from deletion through this API. The error is a hard usage error, not a runtime failure.

Source

Thrown at internal/backend/remote-state/oci/backend_state.go:195

					wss = append(wss, name)
				}
			}
		}
		if len(listObjectResponse.Objects) < maxKeys {
			break
		}
		start = listObjectResponse.NextStartWith

	}

	return uniqueStrings(wss), diags
}

func (b *Backend) DeleteWorkspace(name string, force bool) tfdiags.Diagnostics {
	var diags tfdiags.Diagnostics

	if name == backend.DefaultStateName || name == "" {
		return diags.Append(fmt.Errorf("can't delete default state"))
	}
	if b.client == nil {
		err := b.configureRemoteClient()
		if err != nil {
			return diags.Append(err)
		}
	}

	b.client.path = b.path(name)
	b.client.lockFilePath = b.getLockFilePath(name)
	return diags.Append(b.client.Delete())

}

View on GitHub (pinned to d32a084675)

Solutions

Do not delete the default workspace — skip it in any cleanup loop.
If you need to clear its state, run `terraform destroy` against the default workspace instead of deleting it.
To remove the state object entirely, destroy resources first, then delete the state object in the bucket manually (this loses Terraform's tracking).

Example fix

// before: deletes every workspace returned by Workspaces()
for _, w := range workspaces {
    backend.DeleteWorkspace(w, false)
}
// after: skip the protected default workspace
for _, w := range workspaces {
    if w == "" || w == backend.DefaultStateName {
        continue
    }
    backend.DeleteWorkspace(w, false)
}

Defensive patterns

Strategy: validation

Validate before calling

// Guard before calling DeleteWorkspace
func safeDelete(b *Backend, name string, force bool) tfdiags.Diagnostics {
    if name == "" || name == backend.DefaultStateName {
        return nil // nothing to do; default is protected
    }
    return b.DeleteWorkspace(name, force)
}

Prevention

Filter 'default' out of any workspace enumeration before deleting.
Document that the default workspace is intentionally non-deletable.
In CI teardown, keep an allowlist of workspaces to delete rather than deleting all.
Treat an empty workspace name as default-equivalent in your tooling.

When it happens

Trigger: Running `terraform workspace delete default`; calling backend.DeleteWorkspace("default") or DeleteWorkspace("") programmatically; automation that enumerates workspaces and tries to delete every entry including default.

Common situations: Cleanup scripts that loop over `terraform workspace list` and delete each; misunderstood workspace model where users assume default is removable; CI teardown logic that does not skip default.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/8417b20ab057793e. Report an issue: GitHub.