How do I restrict the ability of users to delete or update resources in my CloudFormation stack?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To prevent deletion or updates to resources in a CloudFormation stack, take the following actions:

• To prevent the deletion of an individual resource at the stack level, use the DeletionPolicy attribute.
• To restrict the user's ability to delete or update a stack and its resources, use AWS Identity and Access Management (IAM) policies.
• To prevent updates to stack resources, assign a stack policy.
• To turn on termination protection, use the CloudFormation console or the AWS Command Line Interface (AWS CLI). This feature restricts the ability of users to delete the stack.

Related information

Understand update behaviors of stack resources

Update your stack template

Troubleshooting CloudFormation