CloudFormation stack has termination protection enabled

Check ID: cloudformation_stacks_termination_protection_enabled
Provider: AWS
Service: cloudformation
Severity: MEDIUM
Categories: resilience
Resource type: AwsCloudFormationStack

What this check verifies

AWS CloudFormation root stacks are evaluated for termination protection. The detection identifies whether termination protection is enabled to block stack deletions on non-nested stacks.

Risk

Without termination protection, human error or automation can delete entire stacks, causing immediate availability loss and potential data destruction of managed resources. Attackers with delete rights can more easily trigger outages and hinder recovery.

Recommendation

Enable termination protection on root stacks for critical workloads. Enforce least privilege on who can alter this setting or delete stacks, require change review via change sets, and apply stack policies plus DeletionPolicy: Retain for data stores for defense in depth.

Remediation

CLI
Terraform
Dashboard steps

aws cloudformation update-termination-protection —stack-name <STACK_NAME> —enable-termination-protection

resource "aws_cloudformation_stack" "<example_resource_name>" {
  name                           = "<example_resource_name>"
  template_url                   = "https://s3.amazonaws.com/<bucket>/<template>.json"
  enable_termination_protection  = true # Critical: enables termination protection to prevent stack deletion
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudformation_stacks_termination_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFormation stack outputs do not contain secrets CloudFront distribution uses a custom SSL/TLS certificate

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires