hashicorp/terraform · error

default state is not allowed to be deleted

Error message

default state is not allowed to be deleted

What it means

Raised by Backend.DeleteWorkspace() (cos/backend_state.go:71) when asked to delete the 'default' workspace or an empty name. The default workspace's state is permanent and cannot be removed through the backend API.

Source

Thrown at internal/backend/remote-state/cos/backend_state.go:71

		parts := strings.Split(strings.TrimPrefix(vv.Key, prefix), "/")
		if len(parts) > 0 && parts[0] != "" {
			ws = append(ws, parts[0])
		}
	}

	sort.Strings(ws[1:])
	log.Printf("[DEBUG] list all workspaces, workspaces: %v", ws)

	return ws, diags
}

// DeleteWorkspace deletes the named workspaces. The "default" state cannot be deleted.
func (b *Backend) DeleteWorkspace(name string, _ bool) tfdiags.Diagnostics {
	var diags tfdiags.Diagnostics
	log.Printf("[DEBUG] delete workspace, workspace: %v", name)

	if name == backend.DefaultStateName || name == "" {
		return tfdiags.Diagnostics{}.Append(fmt.Errorf("default state is not allowed to be deleted"))
	}

	c, err := b.client(name)
	if err != nil {
		return diags.Append(err)
	}

	return diags.Append(c.Delete())
}

// StateMgr manage the state, if the named state not exists, a new file will created
func (b *Backend) StateMgr(name string) (statemgr.Full, tfdiags.Diagnostics) {
	var diags tfdiags.Diagnostics
	log.Printf("[DEBUG] state manager, current workspace: %v", name)

	c, err := b.client(name)
	if err != nil {
		return nil, diags.Append(err)

View on GitHub (pinned to c9def3e214)

Solutions

1. Skip the 'default' workspace in any deletion loop.
2. To remove a non-default workspace, delete it by its explicit name.
3. Treat the default state as immutable for deletion purposes.

Example fix

// before: deletes every workspace, including default
for ws in $(terraform workspace list); do terraform workspace delete $ws; done
// after: skip default
for ws in $(terraform workspace list | sed 's/* //'); do
  [ "$ws" = "default" ] && continue
  terraform workspace delete "$ws"
done

// Guard deletion loops against the default workspace
func safeDelete(b *Backend, name string) error {
    if name == backend.DefaultStateName || strings.TrimSpace(name) == "" {
        return fmt.Errorf("default state is not allowed to be deleted")
    }
    return nil
}

When it happens

Trigger: Calling DeleteWorkspace(backend.DefaultStateName) or DeleteWorkspace(""); e.g. `terraform workspace delete default` or an automation script iterating all workspaces including default.

Common situations: A cleanup script that lists workspaces and deletes each one without skipping 'default'; misconfigured workspace name resolving to empty.

Related errors

• Failed to lock cos state: %s
• state name not allow to be empty
• prefix must not start with '/' or './'
• key can not start and end with '/'
• acl value invalid, expected %s or %s, got %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/8f0365a2372634be. Report an issue: GitHub.