A provider network (and associated methods) permits virtual machine instances to be terminated but imposes some checks to reduce the risk that an instance is unintentionally terminated. In one example, a safety stock threshold is imposed for a group of instances. If terminating instances within that group would cause a violation of the safety stock threshold, the provider network requests confirmation for the instances to be terminated. In another example, a time delay is imposed after receipt of an instance termination request before the instance is actually terminated. During the time delay, the instance is transitioned to an idle state but otherwise persists on its host computer thereby allowing time to revoke the instance termination. In yet another example, the provider network obtains independent confirmation of the identities of all instances to be terminated before such instances can be terminated pursuant to a termination request.