How do I restrict the ability of users to delete or update resources in my CloudFormation stack?

Resolution

To prevent deletion or updates to resources in a CloudFormation stack, take the following actions:

• To prevent the deletion of an individual resource at the stack level, use the DeletionPolicy attribute.
• To restrict the user's ability to delete or update a stack and its resources, use AWS Identity and Access Management (IAM) policies.
• To prevent updates to stack resources, assign a stack policy.
• To turn on termination protection, use the CloudFormation console or the AWS Command Line Interface (AWS CLI). This feature restricts the ability of users to delete the stack.

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Related information

Understand update behaviors of stack resources

Update your stack template

Troubleshooting CloudFormation