Question

A DevOps team manages a production CloudFormation stack containing a shared VPC, transit gateway attachments, and a KMS key used by multiple downstream stacks. During a recent incident, an engineer ran `aws cloudformation delete-stack` against the wrong stack name from a scripting error, and the deletion began before it was cancelled. The team wants to guarantee that no accidental or automated API call can delete this foundational stack, while still allowing normal stack UPDATE operations to proceed through their CI/CD pipeline. What should they implement?

Accepted Answer

Enable termination protection on the stack so delete-stack calls are rejected until protection is explicitly disabled.

Answer

Enable termination protection on the stack, and set DeletionPolicy: Retain on the resources inside the stack.

Answer

Apply a stack policy that denies the Update:Delete action on all resources in the stack.

Answer

Attach an IAM policy to all pipeline roles that denies cloudformation:DeleteStack on every stack in the account.