# Ensure CloudFormation Stack Has Termination Protection Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890025305181-ensure-cloudformation-stack-has-termination-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that AWS CloudFormation stacks supporting production resources have Termination protection enabled, so that the stack (and the resources it manages) cannot be accidentally deleted via the DeleteStack action without first explicitly disabling this protection.

**Rationale**

Deleting a CloudFormation stack deletes every resource it manages (unless a resource's DeletionPolicy specifies otherwise), so an accidental stack deletion, whether from a console misclick, a scripting error, or a compromised credential, can result in significant, immediate loss of infrastructure and, potentially, data. Enabling Termination protection requires an explicit, deliberate step to disable protection before the stack can be deleted, guarding against this class of accident.

**Impact**

-   Prevents accidental deletion of a stack and all the resources it manages
    
-   Requires an explicit, deliberate action to disable protection before legitimate stack deletion
    
-   Adds an extra step to legitimate decommissioning workflows for the stack
    

**Default Value**

Termination protection is disabled by default on newly created CloudFormation stacks.

**Pre-Requisites**

-   IAM permissions to update stack settings (cloudformation:UpdateTerminationProtection)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudFormation > Stacks.
    
3.  Select the stack to review.
    
4.  Open the Stack info tab.
    
5.  Verify that Termination protection shows as Activated.
    
6.  If Termination protection is Deactivated for a production stack, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudFormation > Stacks and select the stack to update.
    
3.  Select Stack actions, then Edit termination protection.
    
4.  Select Activate.
    
5.  Confirm the change.
    
6.  Verify the Stack info tab now shows Termination protection as Activated.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudFormation > Stacks and select the affected stack.
    
3.  Select Stack actions, then Edit termination protection.
    
4.  Select Deactivate.
    
5.  Confirm the change.
    

**Reference**

-   [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stacks.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stacks.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.