Description

Ensure that Amazon EKS clusters have Deletion protection enabled, so that the cluster cannot be deleted via the console, EKS API, CLI, eksctl, or infrastructure-as-code tools without first explicitly disabling this protection.

Rationale

Deleting an EKS cluster removes the Kubernetes control plane and can result in significant downtime and configuration loss for all workloads running on it, and without deletion protection, this can be triggered accidentally by an automation error, a scripting mistake, or a compromised credential. Enabling deletion protection requires an explicit, deliberate step (disabling the protection) before the cluster can be deleted, guarding against this class of accident.

Impact

  • Prevents accidental or unauthorized deletion of a critical EKS cluster and disruption of the workloads running on it

  • Requires an explicit, deliberate action to disable protection before legitimate cluster deletion

  • Adds an extra step to legitimate cluster decommissioning workflows

Default Value

Deletion protection is turned off by default for all new and existing EKS clusters.

Pre-Requisites

  • IAM permissions to update cluster configuration (eks:UpdateClusterConfig)

  • A cluster running a Kubernetes/platform version that supports the deletion protection feature

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EKS > Clusters and select the cluster to review.

  3. Open the Overview tab.

  4. Verify that Deletion protection shows as Enabled.

  5. If Deletion protection is disabled for a production cluster, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EKS > Clusters and select the cluster to update.

  3. Select Update on the cluster overview, or use the CLI: aws eks update-cluster-config --name CLUSTER_NAME --deletion-protection.

  4. Enable Deletion protection and confirm the update.

  5. Verify the Overview tab now shows Deletion protection as Enabled.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EKS > Clusters and select the affected cluster.

  3. Select Update, or use the CLI: aws eks update-cluster-config --name CLUSTER_NAME --no-deletion-protection.

  4. Disable Deletion protection and confirm the update.

Reference