CloudFormation Deletion Policy Should Be in Use

Using Console

The CloudFormation deletion policy should be in use to ensure that resources created by CloudFormation are not accidentally deleted.To remediate this misconfiguration in AWS using the AWS console, follow the below steps:

Go to the AWS CloudFormation console.
Select the stack for which you want to enable deletion protection.
Click on the “Stack actions” button and select “Update stack”.
In the “Specify stack details” page, scroll down to the “Advanced” section.
In the “Deletion policy” section, select the “Retain” option for resources that you want to protect from deletion.
Click on the “Next” button.
In the “Review” page, review the changes and click on the “Update stack” button to apply the changes.

Once the deletion policy is enabled, the resources specified in the policy will not be deleted even if the CloudFormation stack is deleted.

Using CLI

To remediate the misconfiguration “CloudFormation Deletion Policy Should Be in Use” for AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to list all the CloudFormation stacks in your account:
aws cloudformation list-stacks
Identify the stack that has the misconfiguration and note down its name.
Run the following command to update the stack with a deletion policy:
aws cloudformation update-stack --stack-name <stack-name> --deletion-policy Retain
Note: Replace <stack-name> with the actual name of the stack that needs to be updated.
Wait for the stack update to complete. You can check the status of the stack update using the following command:
aws cloudformation describe-stacks --stack-name <stack-name> --query "Stacks[].StackStatus"
Note: Replace <stack-name> with the actual name of the stack that needs to be updated.
Verify that the deletion policy has been set correctly by running the following command:
aws cloudformation describe-stack-resource --stack-name <stack-name> --logical-resource-id <logical-resource-id>
Note: Replace <stack-name> with the actual name of the stack that needs to be updated and <logical-resource-id> with the ID of the resource that needs to be retained.
Repeat steps 4-6 for any other stacks that have the misconfiguration.

By following these steps, you can remediate the misconfiguration “CloudFormation Deletion Policy Should Be in Use” for AWS using AWS CLI.

Using Python

To remediate the misconfiguration “CloudFormation Deletion Policy Should Be in Use” in AWS using Python, follow these steps:

Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

Create a Boto3 client for CloudFormation:

import boto3

client = boto3.client('cloudformation')

Retrieve the list of CloudFormation stacks:

response = client.list_stacks(
    StackStatusFilter=[
        'CREATE_COMPLETE',
        'UPDATE_COMPLETE',
        'ROLLBACK_COMPLETE'
    ]
)

stack_names = [stack['StackName'] for stack in response['StackSummaries']]

For each stack, retrieve its resources and check if a DeletionPolicy is defined:

for stack_name in stack_names:
    response = client.describe_stack_resources(StackName=stack_name)
    
    for resource in response['StackResources']:
        if 'DeletionPolicy' not in resource:
            print(f"Resource {resource['LogicalResourceId']} in stack {stack_name} does not have a DeletionPolicy defined.")

If a resource is found without a DeletionPolicy, add one using the update_stack method:

client.update_stack(
    StackName=stack_name,
    UsePreviousTemplate=True,
    Capabilities=[
        'CAPABILITY_NAMED_IAM'
    ],
    ResourceTypes=[
        'AWS::*'
    ],
    StackPolicyBody='{"Statement": [{"Effect": "Allow", "Action": "Update:*", "Principal": "*", "Resource": "*"}]}',
    DeletionPolicy='Retain'
)

In the above example, the DeletionPolicy is set to ‘Retain’, which means that the resource will not be deleted when the CloudFormation stack is deleted. You can choose a different DeletionPolicy based on your requirements.

Run the script periodically to ensure that all CloudFormation stacks have a DeletionPolicy defined for their resources.

Using Terraform

# Terraform cannot set a CloudFormation DeletionPolicy on the stack itself.
# The DeletionPolicy is defined **inside the CloudFormation template** on each resource,
# and the aws_cloudformation_stack resource has no argument for it.

# Example: the Terraform-managed stack just points at the template that must
# already contain DeletionPolicy attributes:
resource "aws_cloudformation_stack" "example" {
  name          = "EXAMPLE_STACK_NAME"          # replace with your stack name
  template_body = file("PATH/TO/TEMPLATE.yaml") # replace with your template path

  # other arguments as needed …
}

Terraform has no way to add or change DeletionPolicy from the aws_cloudformation_stack resource; you must set it on the resources inside the CloudFormation template (e.g., DeletionPolicy: Retain or DeletionPolicy: Snapshot on the template’s resources) via your template source. After updating the template, terraform plan should show an update to template_body (or template_url) for the aws_cloudformation_stack resource, with no other changes.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

CloudFormation Deletion Policy Should Be in Use

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: