Destroy policy

Destroy should clean up your utopia resources — not someone else's bucket that happens to share a name.

Mode	Rule
Default	Utopia tags must match current utopia:project + utopia:env
--force	Any utopia-tagged resource; still refuses untagged
Untagged	Always refused (e.g. BUCKET_NOT_MANAGED, exit 5)

Mismatch without --force → project-mismatch error, exit 5, with a hint to switch project or pass --force.

Same ownership model applies to bucket share and secret get when they need cross-project access. Functions, crons, sites, servers, databases, and kv tables use the same rules.

For databases, --keep-data takes a final RDS snapshot before delete; without it, data is gone after confirm.

Versioned empty (buckets)

Before DeleteBucket, awsutopia:

1. Lists object versions + delete markers
2. Bulk DeleteObjects (with per-object fallback)
3. DeleteBucket

--dry-run may still read tags/versions to print the plan; it never mutates.