Back to Checks
aws

CloudFormation stack has termination protection enabled

cloudformation_stacks_termination_protection_enabled
Service: cloudformationSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsCloudFormationStack

AWS CloudFormation root stacks are evaluated for termination protection. The detection identifies whether termination protection is enabled to block stack deletions on non-nested stacks.

Prowler logoProwlerprowler-provider-aws

Risk

Without termination protection, human error or automation can delete entire stacks, causing immediate availability loss and potential data destruction of managed resources.

Attackers with delete rights can more easily trigger outages and hinder recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudformation_stacks_termination_protection_enabled

Recommendation

Enable termination protection on root stacks for critical workloads. Enforce least privilege on who can alter this setting or delete stacks, require change review via change sets, and apply stack policies plus DeletionPolicy: Retain for data stores for defense in depth.

Remediation

CLI

aws cloudformation update-termination-protection --stack-name <STACK_NAME> --enable-termination-protection

Terraform

resource "aws_cloudformation_stack" "<example_resource_name>" {
  name                           = "<example_resource_name>"
  template_url                   = "https://s3.amazonaws.com/<bucket>/<template>.json"
  enable_termination_protection  = true # Critical: enables termination protection to prevent stack deletion
}

Other

1Open the AWS CloudFormation console
2Select the target stack
3Choose Stack actions > Edit termination protection
4Select Enable and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudformation.cloudformation_client import (
    cloudformation_client,
)


class cloudformation_stacks_termination_protection_enabled(Check):
    """Check if a CloudFormation Stack has the Termination Protection enabled"""

    def execute(self):
        """Execute the cloudformation_stacks_termination_protection_enabled check"""
        findings = []
        for stack in cloudformation_client.stacks:
            if not stack.is_nested_stack:
                report = Check_Report_AWS(metadata=self.metadata(), resource=stack)

                if stack.enable_termination_protection:
                    report.status = "PASS"
                    report.status_extended = f"CloudFormation Stack {stack.name} has termination protection enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"CloudFormation Stack {stack.name} has termination protection disabled."
                findings.append(report)

        return findings

References