# Ensure EKS cluster has deletion protection enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292241410406-ensure-eks-cluster-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon Elastic Kubernetes Service (EKS) cluster has deletion protection enabled. When deletion protection is on, the cluster cannot be deleted until the protection is explicitly turned off. Clusters whose API response does not report the setting are treated as protected.

**Rationale**

Without deletion protection, an automation error, a mistaken command or a compromised administrator account can delete the cluster control plane in a single action. This causes an immediate outage of every workload on the cluster, can leave orphaned resources and makes recovery slow and costly. Enabling deletion protection on important clusters, limiting who can change or delete clusters, and requiring change approval reduces this risk.

**Impact**

-   Prevents accidental or unauthorized deletion of the cluster
    
-   Deleting the cluster on purpose requires an extra step to turn protection off first, which must be added to decommissioning procedures and automation (for example, infrastructure-as-code pipelines)
    
-   Running workloads are not affected
    

**Default Value**

Deletion protection is an optional cluster setting. Unless it was turned on when the cluster was created or afterwards, the cluster can be deleted without first disabling protection.

**Pre-Requisites**

-   IAM permissions: eks:ListClusters, eks:DescribeCluster and eks:UpdateClusterConfig
    
-   An AWS CLI version that supports the --deletion-protection option of aws eks update-cluster-config
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EKS console and select **Clusters**.
    
3.  Open each cluster and check whether deletion protection is enabled in the cluster details.
    
4.  Repeat for each region in use.
    
5.  If deletion protection is disabled for any cluster, follow the implementation steps.
    

**CLI:**

List the clusters in a region:

aws eks list-clusters --region <REGION>

Show the deletion protection setting of a cluster:

aws eks describe-cluster --name <CLUSTER\_NAME> --region <REGION> --query "cluster.\[name,deletionProtection\]"

A cluster fails if deletionProtection is false.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EKS console and select **Clusters**, then the cluster.
    
3.  In the cluster details, find the deletion protection setting and choose to edit it.
    
4.  Turn on deletion protection.
    
5.  Save the changes.
    
6.  Repeat for each affected cluster in each region in use.
    

**CLI:**

Enable deletion protection for a cluster:

aws eks update-cluster-config --name <CLUSTER\_NAME> --deletion-protection --region <REGION>

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EKS console and select the cluster.
    
3.  In the cluster details, edit the deletion protection setting and turn it off.
    
4.  Save the changes.
    

**CLI:**

aws eks update-cluster-config --name <CLUSTER\_NAME> --no-deletion-protection --region <REGION>

Note: with deletion protection turned off, the cluster can be deleted in a single action again.

**Reference**

-   [https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html](https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html)
    
-   [https://docs.aws.amazon.com/eks/latest/APIReference/API\_UpdateClusterConfig.html](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/eks/update-cluster-config.html](https://docs.aws.amazon.com/cli/latest/reference/eks/update-cluster-config.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.