Back to Checks
aws

EKS cluster has deletion protection enabled

eks_cluster_deletion_protection_enabled
Service: eksSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEksCluster

Amazon EKS clusters have deletion protection enabled blocking cluster removal until protection is explicitly disabled.

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, automation errors or a compromised admin can remove the cluster control plane, causing immediate availability loss and downtime. Destructive actions can also affect the integrity of deployments, leave orphaned resources, hinder recovery, and raise operational cost.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_deletion_protection_enabled

Recommendation

Enable deletion protection on critical clusters (deletionProtection=true). Enforce least privilege so only narrowly scoped roles can disable or delete clusters. Require change control with approvals and separation of duties, and apply guardrails to prevent broad delete permissions.

Remediation

CLI

aws eks update-cluster-config --name <cluster_name> --region <region_name> --deletion-protection

Terraform

# Enable deletion protection for the EKS cluster
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids = ["<subnet_id_1>", "<subnet_id_2>"]
  }

  deletion_protection = true  # critical: prevents cluster deletion until disabled
}

NativeIaC

# CloudFormation: enable deletion protection on the EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds: [<example_subnet_id_1>, <example_subnet_id_2>]
      DeletionProtection: true  # critical: prevents cluster deletion until disabled

Other

1Open the AWS Management Console and go to Amazon EKS
2Select your cluster
3Go to the Configuration tab and click Edit
4Enable Deletion protection
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_deletion_protection_enabled(Check):
    def execute(self):
        findings = []
        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"EKS cluster {cluster.name} has deletion protection enabled."
            )
            if cluster.deletion_protection is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"EKS cluster {cluster.name} has deletion protection disabled."
                )
            findings.append(report)

        return findings

References