Find CloudFormation Stacks Without Termination Protection

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadStacks",
      "Effect": "Allow",
      "Action": ["cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:GetTemplate"],
      "Resource": "arn:aws:cloudformation:*:111122223333:stack/*/*"
    },
    {
      "Sid": "EnableProtectionOnlyWithApply",
      "Effect": "Allow",
      "Action": "cloudformation:UpdateTerminationProtection",
      "Resource": "arn:aws:cloudformation:*:111122223333:stack/*/*"
    }
  ]
}

// find-cloudformation-stacks-without-termination-protection.ts
// Lists root CloudFormation stacks in a Region that don't have termination protection, with their age,
// resource count, stateful resources (databases, buckets, file systems...) and how many resources the
// processed template marks with a DeletionPolicy of Retain, RetainExceptOnCreate or Snapshot.
// Nested stacks are skipped: they inherit the setting from their root stack.
// --apply turns termination protection ON for the stacks you pick by --names or by --tag key=value.
// Usage:
//   npx tsx find-cloudformation-stacks-without-termination-protection.ts [--region eu-west-1]
//   npx tsx find-cloudformation-stacks-without-termination-protection.ts --apply --tag env=prod
//   npx tsx find-cloudformation-stacks-without-termination-protection.ts --apply --names billing-api,shared-vpc
import {
  CloudFormationClient,
  GetTemplateCommand,
  UpdateTerminationProtectionCommand,
  paginateDescribeStacks,
  paginateListStackResources,
  type Stack,
} from "@aws-sdk/client-cloudformation";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const region = flag("--region") ?? process.env.AWS_REGION ?? "us-east-1";
const apply = args.includes("--apply");
const names = new Set((flag("--names") ?? "").split(",").map((s) => s.trim()).filter(Boolean));
const [tagKey, tagValue] = (flag("--tag") ?? "").split("=");
if (apply && !names.size && !tagKey) {
  console.error("--apply needs --names a,b or --tag key=value");
  process.exit(1);
}

const cfn = new CloudFormationClient({ region });
const DAY = 86_400_000;
const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

// Resource types that hold data you can't get back by redeploying the template
const STATEFUL = new Set([
  "AWS::RDS::DBInstance",
  "AWS::RDS::DBCluster",
  "AWS::DynamoDB::Table",
  "AWS::DynamoDB::GlobalTable",
  "AWS::S3::Bucket",
  "AWS::EFS::FileSystem",
  "AWS::EC2::Volume",
  "AWS::ElastiCache::ReplicationGroup",
  "AWS::OpenSearchService::Domain",
  "AWS::Cognito::UserPool",
  "AWS::KMS::Key",
  "AWS::Kinesis::Stream",
]);

async function inspect(stackName: string): Promise<{ total: number; stateful: number; retained: number }> {
  let total = 0;
  let stateful = 0;
  for await (const page of paginateListStackResources({ client: cfn }, { StackName: stackName })) {
    for (const r of page.StackResourceSummaries ?? []) {
      if (r.ResourceStatus === "DELETE_COMPLETE") continue;
      total++;
      if (r.ResourceType && STATEFUL.has(r.ResourceType)) stateful++;
    }
  }
  // Counts DeletionPolicy lines in the processed template (JSON or YAML) - an approximation, not a parser
  const tpl = await cfn.send(new GetTemplateCommand({ StackName: stackName, TemplateStage: "Processed" }));
  const body = tpl.TemplateBody ?? "";
  const retained = [...body.matchAll(/"?DeletionPolicy"?\s*:\s*"?(Retain|RetainExceptOnCreate|Snapshot)\b/g)].length;
  return { total, stateful, retained };
}

const selected = (s: Stack): boolean =>
  names.has(s.StackName ?? "") || (!!tagKey && (s.Tags ?? []).some((t) => t.Key === tagKey && t.Value === tagValue));

async function main(): Promise<void> {
  const rows: Record<string, string | number>[] = [];
  const toProtect: string[] = [];
  let protectedCount = 0;
  let nested = 0;
  for await (const page of paginateDescribeStacks({ client: cfn }, {})) {
    for (const s of page.Stacks ?? []) {
      if (!s.StackName || s.StackStatus === "DELETE_COMPLETE" || s.StackStatus === "DELETE_IN_PROGRESS") continue;
      if (s.ParentId || s.RootId) {
        nested++; // termination protection is set on the root stack only
        continue;
      }
      if (s.EnableTerminationProtection) {
        protectedCount++;
        continue;
      }
      const ageDays = s.CreationTime ? Math.floor((Date.now() - s.CreationTime.getTime()) / DAY) : 0;
      let detail = { total: 0, stateful: 0, retained: 0 };
      try {
        detail = await inspect(s.StackName);
      } catch (err) {
        console.error(`Could not inspect ${s.StackName}: ${errText(err)}`);
      }
      const env = (s.Tags ?? []).find((t) => t.Key === (tagKey || "env"))?.Value ?? "-";
      rows.push({
        Stack: s.StackName,
        Status: s.StackStatus ?? "?",
        AgeDays: ageDays,
        Tag: env,
        Resources: detail.total,
        Stateful: detail.stateful,
        RetainedInTemplate: detail.retained,
        Finding: detail.stateful > detail.retained ? "UNPROTECTED: stateful resources without Retain" : "unprotected",
      });
      if (selected(s)) toProtect.push(s.StackName);
    }
  }
  rows.sort((a, b) => Number(b.Stateful) - Number(a.Stateful));
  console.table(rows);
  console.log(
    `${region}: ${rows.length} root stacks without termination protection, ${protectedCount} with it, ${nested} nested skipped.`,
  );

  if (!apply) {
    console.log("Report only: nothing was changed. Use --apply with --names or --tag to enable protection.");
    return;
  }
  for (const name of toProtect) {
    try {
      await cfn.send(new UpdateTerminationProtectionCommand({ StackName: name, EnableTerminationProtection: true }));
      console.log(`Enabled termination protection on ${name}`);
    } catch (err) {
      console.error(`Could not update ${name}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-cloudformation
npm install --save-dev tsx typescript @types/node

# Report only
AWS_PROFILE=readonly npx tsx find-cloudformation-stacks-without-termination-protection.ts --region eu-west-1

# Enable protection on every unprotected root stack tagged env=prod
AWS_PROFILE=platform-admin npx tsx find-cloudformation-stacks-without-termination-protection.ts \
  --region eu-west-1 --apply --tag env=prod

┌─────────┬───────────────────┬───────────────────┬─────────┬────────┬───────────┬──────────┬────────────────────┬──────────────────────────────────────────────────┐
│ (index) │ Stack             │ Status            │ AgeDays │ Tag    │ Resources │ Stateful │ RetainedInTemplate │ Finding                                          │
├─────────┼───────────────────┼───────────────────┼─────────┼────────┼───────────┼──────────┼────────────────────┼──────────────────────────────────────────────────┤
│ 0       │ 'billing-api'     │ 'UPDATE_COMPLETE' │ 612     │ 'prod' │ 6         │ 3        │ 1                  │ 'UNPROTECTED: stateful resources without Retain' │
│ 1       │ 'analytics-lake'  │ 'UPDATE_COMPLETE' │ 420     │ 'prod' │ 3         │ 2        │ 2                  │ 'unprotected'                                    │
│ 2       │ 'pr-1432-preview' │ 'UPDATE_COMPLETE' │ 3       │ 'dev'  │ 2         │ 1        │ 0                  │ 'UNPROTECTED: stateful resources without Retain' │
│ 3       │ 'shared-vpc'      │ 'UPDATE_COMPLETE' │ 1040    │ 'prod' │ 4         │ 0        │ 0                  │ 'unprotected'                                    │
└─────────┴───────────────────┴───────────────────┴─────────┴────────┴───────────┴──────────┴────────────────────┴──────────────────────────────────────────────────┘
eu-west-1: 4 root stacks without termination protection, 2 with it, 1 nested skipped.
Report only: nothing was changed. Use --apply with --names or --tag to enable protection.