EKS cluster has deletion protection enabled

Check ID: eks_cluster_deletion_protection_enabled
Provider: AWS
Service: eks
Severity: HIGH
Categories: resilience
Resource type: AwsEksCluster

What this check verifies

Amazon EKS clusters have deletion protection enabled blocking cluster removal until protection is explicitly disabled.

Risk

Without deletion protection, automation errors or a compromised admin can remove the cluster control plane, causing immediate availability loss and downtime. Destructive actions can also affect the integrity of deployments, leave orphaned resources, hinder recovery, and raise operational cost.

Recommendation

Enable deletion protection on critical clusters (deletionProtection=true). Enforce least privilege so only narrowly scoped roles can disable or delete clusters. Require change control with approvals and separation of duties, and apply guardrails to prevent broad delete permissions.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-config —name <cluster_name> —region <region_name> —deletion-protection

# Enable deletion protection for the EKS cluster
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids = ["<subnet_id_1>", "<subnet_id_2>"]
  }

  deletion_protection = true  # critical: prevents cluster deletion until disabled
}

# CloudFormation: enable deletion protection on the EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds: [<example_subnet_id_1>, <example_subnet_id_2>]
      DeletionProtection: true  # critical: prevents cluster deletion until disabled

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_deletion_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EFS file system policy is not open to the whole VPC EKS cluster has Kubernetes secrets encryption enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires