Description

Ensure that termination protection is enabled on every AWS CloudFormation root stack. When termination protection is enabled, any attempt to delete the stack fails until the protection is turned off. Nested stacks inherit the setting from their root stack and are not evaluated separately.

Rationale

Without termination protection, a single delete action by a user, a misconfigured pipeline or an attacker with delete permissions removes the stack and all of the resources it manages. This can cause an immediate outage and permanent loss of data stores that do not have a retain policy. Termination protection adds a deliberate extra step before deletion, and works best together with least privilege on who can change the setting, stack policies and DeletionPolicy: Retain for data stores.

Impact

  • Protects stacks and their resources from accidental or unauthorized deletion

  • Stack updates are not affected; only stack deletion is blocked

  • Planned stack deletions, including those by automation, require turning off termination protection first

Default Value

Termination protection is disabled by default when a stack is created.

Pre-Requisites

  • IAM permissions: cloudformation:DescribeStacks and cloudformation:UpdateTerminationProtection

  • Confirmation that no automated process needs to delete the stack without first turning off termination protection

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS CloudFormation console and select Stacks.

  3. Select a stack that is not marked as NESTED and open the Stack info tab.

  4. Check the value of Termination protection.

  5. Repeat for each stack in each region in use.

  6. If termination protection is Deactivated on any root stack, follow the implementation steps.

CLI:

Show the termination protection setting of all root stacks in a region:

aws cloudformation describe-stacks --region <REGION> --query "Stacks[?RootId==null].[StackName,EnableTerminationProtection]" --output table

A root stack fails if EnableTerminationProtection is False. Nested stacks (stacks that have a RootId) are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS CloudFormation console and select Stacks.

  3. Select the root stack.

  4. Choose Stack actions, then Edit termination protection.

  5. Select Activated and choose Save.

  6. Repeat for each affected stack in each region in use.

CLI:

Enable termination protection on a stack:

aws cloudformation update-termination-protection --region <REGION> --stack-name <STACK_NAME> --enable-termination-protection

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS CloudFormation console and select the stack.

  3. Choose Stack actions, then Edit termination protection.

  4. Select Deactivated and choose Save.

CLI:

aws cloudformation update-termination-protection --region <REGION> --stack-name <STACK_NAME> --no-enable-termination-protection

Note: turning off termination protection allows the stack and its resources to be deleted again.

Reference