Terraform "deleting ...: DependencyViolation" in CI

By Daniel Zoghalchali·Latchkey

AWS will not delete a resource that still has dependents -- a VPC with subnets, a security group still attached to an ENI, a subnet with running instances -- so the delete API returns DependencyViolation.

What this error means

destroy (or a replace that deletes first) fails with DependencyViolation naming the resource. It happens when something outside Terraform attached to the resource, or ordering left a dependent alive.

Error: deleting EC2 Subnet (subnet-0abc123): operation error EC2: DeleteSubnet,
https response error StatusCode: 400, DependencyViolation: The subnet
'subnet-0abc123' has dependencies and cannot be deleted.

  with aws_subnet.app,
  on network.tf line 8, in resource "aws_subnet" "app":

Common causes

Out-of-band dependents still attached

A resource created outside Terraform (a manually launched ENI, a lingering ELB) still references the resource being deleted.

Deletion ordering or stale references

A dependent Terraform did not delete first, or a leftover network interface, keeps the parent resource in use.

How to fix it

Find and remove the dependents first

Identify what still references the resource, delete those, then re-run destroy.

# example: what is still in the subnet / using the SG
aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=subnet-0abc123
# delete or detach the dependents, then:
terraform destroy

Fix ordering inside the config

1. Ensure dependent resources are managed by Terraform so they delete in order.
2. Add explicit depends_on where deletion order is ambiguous.
3. Re-run destroy after dependents are gone.

How to prevent it

• Manage dependent resources in Terraform so destroy ordering is correct.
• Watch for out-of-band ENIs/attachments that block deletion.
• Use depends_on to make teardown order explicit where needed.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation