CloudFormation Deletion Policy Should Be in Use
More Info:
A deletion policy, implemented with the DeletionPolicy attribute, should be used for your Amazon CloudFormation stacks in order preserve or backup AWS resources when the stacks are deleted.Risk Level
LowAddress
Security, Operational MaturityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
The CloudFormation deletion policy should be in use to ensure that resources created by CloudFormation are not accidentally deleted.To remediate this misconfiguration in AWS using the AWS console, follow the below steps:
- Go to the AWS CloudFormation console.
- Select the stack for which you want to enable deletion protection.
- Click on the “Stack actions” button and select “Update stack”.
- In the “Specify stack details” page, scroll down to the “Advanced” section.
- In the “Deletion policy” section, select the “Retain” option for resources that you want to protect from deletion.
- Click on the “Next” button.
- In the “Review” page, review the changes and click on the “Update stack” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “CloudFormation Deletion Policy Should Be in Use” for AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or EC2 instance.
-
Run the following command to list all the CloudFormation stacks in your account:
- Identify the stack that has the misconfiguration and note down its name.
-
Run the following command to update the stack with a deletion policy:
Note: Replace
<stack-name>with the actual name of the stack that needs to be updated. -
Wait for the stack update to complete. You can check the status of the stack update using the following command:
Note: Replace
<stack-name>with the actual name of the stack that needs to be updated. -
Verify that the deletion policy has been set correctly by running the following command:
Note: Replace
<stack-name>with the actual name of the stack that needs to be updated and<logical-resource-id>with the ID of the resource that needs to be retained. - Repeat steps 4-6 for any other stacks that have the misconfiguration.
Using Python
Using Python
To remediate the misconfiguration “CloudFormation Deletion Policy Should Be in Use” in AWS using Python, follow these steps:In the above example, the DeletionPolicy is set to ‘Retain’, which means that the resource will not be deleted when the CloudFormation stack is deleted. You can choose a different DeletionPolicy based on your requirements.
- Install the AWS SDK for Python (Boto3) using pip:
- Create a Boto3 client for CloudFormation:
- Retrieve the list of CloudFormation stacks:
- For each stack, retrieve its resources and check if a DeletionPolicy is defined:
- If a resource is found without a DeletionPolicy, add one using the
update_stackmethod:
- Run the script periodically to ensure that all CloudFormation stacks have a DeletionPolicy defined for their resources.