Project: KICS (Provisioning / Security & Compliance)
File: fe974ae9-858e-4991-bbd5-e040a834679f.md

title: Stack Retention Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fe974ae9-858e-4991-bbd5-e040a834679f Query name: Stack Retention Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: Make sure that retain_stack is enabled to keep the Stack and it's associated resources during resource destruction<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="35 39 11 18 27" AWSTemplateFormatVersion: '2010-09-09' Resources: stackset3: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink AutoDeployment: Enabled: true RetainStacksOnAccountRemoval: false stackset4: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink AutoDeployment: Enabled: true stackset5: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink AutoDeployment: Enabled: false RetainStacksOnAccountRemoval: true stackset6: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink AutoDeployment: RetainStacksOnAccountRemoval: false stackset7: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink ``` ```json title="Positive test num. 2 - json file" hl_lines="34 12 45 52 22" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "stackset8": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink", "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": false } } }, "stackset9": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink", "AutoDeployment": { "Enabled": true } } }, "stackset10": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink", "AutoDeployment": { "Enabled": false, "RetainStacksOnAccountRemoval": false } } }, "stackset11": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink", "AutoDeployment": { "RetainStacksOnAccountRemoval": false } } }, "stackset12": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Resources: stackset: Type: AWS::CloudFormation::StackSet Properties: PermissionModel: SERVICE_MANAGED StackSetName: somestackname TemplateURL: somestacklink AutoDeployment: Enabled: true RetainStacksOnAccountRemoval: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "stackset2": { "Type": "AWS::CloudFormation::Stack", "Properties": { "PermissionModel": "SERVICE_MANAGED", "StackSetName": "somestackname", "TemplateURL": "somestacklink", "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": true } } } } } ```