# Ensure EKS Cluster Has Deletion Protection Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890034431692-ensure-eks-cluster-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon EKS clusters have Deletion protection enabled, so that the cluster cannot be deleted via the console, EKS API, CLI, eksctl, or infrastructure-as-code tools without first explicitly disabling this protection.

**Rationale**

Deleting an EKS cluster removes the Kubernetes control plane and can result in significant downtime and configuration loss for all workloads running on it, and without deletion protection, this can be triggered accidentally by an automation error, a scripting mistake, or a compromised credential. Enabling deletion protection requires an explicit, deliberate step (disabling the protection) before the cluster can be deleted, guarding against this class of accident.

**Impact**

-   Prevents accidental or unauthorized deletion of a critical EKS cluster and disruption of the workloads running on it
    
-   Requires an explicit, deliberate action to disable protection before legitimate cluster deletion
    
-   Adds an extra step to legitimate cluster decommissioning workflows
    

**Default Value**

Deletion protection is turned off by default for all new and existing EKS clusters.

**Pre-Requisites**

-   IAM permissions to update cluster configuration (eks:UpdateClusterConfig)
    
-   A cluster running a Kubernetes/platform version that supports the deletion protection feature
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the cluster to review.
    
3.  Open the Overview tab.
    
4.  Verify that Deletion protection shows as Enabled.
    
5.  If Deletion protection is disabled for a production cluster, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the cluster to update.
    
3.  Select Update on the cluster overview, or use the CLI: aws eks update-cluster-config --name CLUSTER\_NAME --deletion-protection.
    
4.  Enable Deletion protection and confirm the update.
    
5.  Verify the Overview tab now shows Deletion protection as Enabled.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the affected cluster.
    
3.  Select Update, or use the CLI: aws eks update-cluster-config --name CLUSTER\_NAME --no-deletion-protection.
    
4.  Disable Deletion protection and confirm the update.
    

**Reference**

-   [https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html](https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.