# Ensure CloudFormation stack has termination protection enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292235152547-ensure-cloudformation-stack-has-termination-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that termination protection is enabled on every AWS CloudFormation root stack. When termination protection is enabled, any attempt to delete the stack fails until the protection is turned off. Nested stacks inherit the setting from their root stack and are not evaluated separately.

**Rationale**

Without termination protection, a single delete action by a user, a misconfigured pipeline or an attacker with delete permissions removes the stack and all of the resources it manages. This can cause an immediate outage and permanent loss of data stores that do not have a retain policy. Termination protection adds a deliberate extra step before deletion, and works best together with least privilege on who can change the setting, stack policies and DeletionPolicy: Retain for data stores.

**Impact**

-   Protects stacks and their resources from accidental or unauthorized deletion
    
-   Stack updates are not affected; only stack deletion is blocked
    
-   Planned stack deletions, including those by automation, require turning off termination protection first
    

**Default Value**

Termination protection is disabled by default when a stack is created.

**Pre-Requisites**

-   IAM permissions: cloudformation:DescribeStacks and cloudformation:UpdateTerminationProtection
    
-   Confirmation that no automated process needs to delete the stack without first turning off termination protection
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the AWS CloudFormation console and select **Stacks**.
    
3.  Select a stack that is not marked as **NESTED** and open the **Stack info** tab.
    
4.  Check the value of **Termination protection**.
    
5.  Repeat for each stack in each region in use.
    
6.  If termination protection is **Deactivated** on any root stack, follow the implementation steps.
    

**CLI:**

Show the termination protection setting of all root stacks in a region:

aws cloudformation describe-stacks --region <REGION> --query "Stacks\[?RootId==null\].\[StackName,EnableTerminationProtection\]" --output table

A root stack fails if EnableTerminationProtection is False. Nested stacks (stacks that have a RootId) are not evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the AWS CloudFormation console and select **Stacks**.
    
3.  Select the root stack.
    
4.  Choose **Stack actions**, then **Edit termination protection**.
    
5.  Select **Activated** and choose **Save**.
    
6.  Repeat for each affected stack in each region in use.
    

**CLI:**

Enable termination protection on a stack:

aws cloudformation update-termination-protection --region <REGION> --stack-name <STACK\_NAME> --enable-termination-protection

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the AWS CloudFormation console and select the stack.
    
3.  Choose **Stack actions**, then **Edit termination protection**.
    
4.  Select **Deactivated** and choose **Save**.
    

**CLI:**

aws cloudformation update-termination-protection --region <REGION> --stack-name <STACK\_NAME> --no-enable-termination-protection

Note: turning off termination protection allows the stack and its resources to be deleted again.

**Reference**

-   [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-termination-protection.html](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-termination-protection.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.