Description

Ensure that every Amazon Elastic Kubernetes Service (EKS) cluster has deletion protection enabled. When deletion protection is on, the cluster cannot be deleted until the protection is explicitly turned off. Clusters whose API response does not report the setting are treated as protected.

Rationale

Without deletion protection, an automation error, a mistaken command or a compromised administrator account can delete the cluster control plane in a single action. This causes an immediate outage of every workload on the cluster, can leave orphaned resources and makes recovery slow and costly. Enabling deletion protection on important clusters, limiting who can change or delete clusters, and requiring change approval reduces this risk.

Impact

  • Prevents accidental or unauthorized deletion of the cluster

  • Deleting the cluster on purpose requires an extra step to turn protection off first, which must be added to decommissioning procedures and automation (for example, infrastructure-as-code pipelines)

  • Running workloads are not affected

Default Value

Deletion protection is an optional cluster setting. Unless it was turned on when the cluster was created or afterwards, the cluster can be deleted without first disabling protection.

Pre-Requisites

  • IAM permissions: eks:ListClusters, eks:DescribeCluster and eks:UpdateClusterConfig

  • An AWS CLI version that supports the --deletion-protection option of aws eks update-cluster-config

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select Clusters.

  3. Open each cluster and check whether deletion protection is enabled in the cluster details.

  4. Repeat for each region in use.

  5. If deletion protection is disabled for any cluster, follow the implementation steps.

CLI:

List the clusters in a region:

aws eks list-clusters --region <REGION>

Show the deletion protection setting of a cluster:

aws eks describe-cluster --name <CLUSTER_NAME> --region <REGION> --query "cluster.[name,deletionProtection]"

A cluster fails if deletionProtection is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select Clusters, then the cluster.

  3. In the cluster details, find the deletion protection setting and choose to edit it.

  4. Turn on deletion protection.

  5. Save the changes.

  6. Repeat for each affected cluster in each region in use.

CLI:

Enable deletion protection for a cluster:

aws eks update-cluster-config --name <CLUSTER_NAME> --deletion-protection --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select the cluster.

  3. In the cluster details, edit the deletion protection setting and turn it off.

  4. Save the changes.

CLI:

aws eks update-cluster-config --name <CLUSTER_NAME> --no-deletion-protection --region <REGION>

Note: with deletion protection turned off, the cluster can be deleted in a single action again.

Reference