Description

Ensure that AWS CloudFormation stacks supporting production resources have Termination protection enabled, so that the stack (and the resources it manages) cannot be accidentally deleted via the DeleteStack action without first explicitly disabling this protection.

Rationale

Deleting a CloudFormation stack deletes every resource it manages (unless a resource's DeletionPolicy specifies otherwise), so an accidental stack deletion, whether from a console misclick, a scripting error, or a compromised credential, can result in significant, immediate loss of infrastructure and, potentially, data. Enabling Termination protection requires an explicit, deliberate step to disable protection before the stack can be deleted, guarding against this class of accident.

Impact

  • Prevents accidental deletion of a stack and all the resources it manages

  • Requires an explicit, deliberate action to disable protection before legitimate stack deletion

  • Adds an extra step to legitimate decommissioning workflows for the stack

Default Value

Termination protection is disabled by default on newly created CloudFormation stacks.

Pre-Requisites

  • IAM permissions to update stack settings (cloudformation:UpdateTerminationProtection)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudFormation > Stacks.

  3. Select the stack to review.

  4. Open the Stack info tab.

  5. Verify that Termination protection shows as Activated.

  6. If Termination protection is Deactivated for a production stack, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudFormation > Stacks and select the stack to update.

  3. Select Stack actions, then Edit termination protection.

  4. Select Activate.

  5. Confirm the change.

  6. Verify the Stack info tab now shows Termination protection as Activated.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudFormation > Stacks and select the affected stack.

  3. Select Stack actions, then Edit termination protection.

  4. Select Deactivate.

  5. Confirm the change.

Reference