How can the company prevent users from accidentally deleting data in this way?
Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.
Configure a stack policy that disallows the deletion of RDS and EBS resources.
Modify IAM policies lo deny deleting RDS and EBS resources that are tagged with an “aws:cloudformation:stack-name” tag.
Use AWS Config rules to prevent deleting RDS and EBS resources.
Explanations:
Adding a DeletionPolicy attribute to RDS and EBS resources in the CloudFormation template ensures that if the stack is deleted, these resources are retained. Possible values for DeletionPolicy include “Retain,” which allows the resources to persist even after the stack deletion. This directly addresses the concern of losing important data.
While configuring a stack policy can restrict actions on certain resources, it cannot prevent the deletion of those resources if the stack itself is deleted. Stack policies are more about controlling updates and management of the stack, not about preventing resource deletion upon stack deletion.
Modifying IAM policies to deny the deletion of RDS and EBS resources based on tags is not an effective solution in this context. Even if the policies are in place, if the stack is deleted, IAM policies won’t prevent the deletion of resources associated with that stack. IAM policies control user permissions but do not prevent resource deletion by CloudFormation itself.
AWS Config rules are used to monitor compliance and resource configurations but do not directly prevent resource deletion. They can alert when changes occur, but they cannot stop the deletion of RDS or EBS resources during a CloudFormation stack deletion. Therefore, this approach does not directly address the concern of data loss.