Prevent AWS CloudFormation from deleting DynamoDB using IAM

Question

I'm trying to create an AWS Role which prevents CloudFormation delete a table. For instance, I created my table as follows:

UsersDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Description: Users DynamoDB Table
    Properties:
      AttributeDefinitions:
        - AttributeName: hashKey
          AttributeType: S
        - AttributeName: rangeKey
          AttributeType: S
      KeySchema:
        - AttributeName: hashKey
          KeyType: HASH
        - AttributeName: rangeKey
          KeyType: RANGE
      BillingMode: PAY_PER_REQUEST
      GlobalSecondaryIndexes:
        - IndexName: index-rangeKey
          KeySchema:
            - AttributeName: rangeKey
              KeyType: HASH
            - AttributeName: hashKey
              KeyType: RANGE
          Projection:
            ProjectionType: ALL

Now suppose that a develop accidentally delete this lines and update stack. This way the table with all its data would be removed. So I'd like to create a role which prevents CloudFormation delete DynamoDB tables. My first attempt was creating the Role below, but it didn't work.

PreventCloudFormationDeleteTableIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: PreventTableDeletePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Deny
                Action:
                  - dynamodb:DeleteTable
                Resource:
                  - !Join
                    - '/'
                    - - !Join [':', ['arn:aws:dynamodb', !Sub '${AWS::Region}', '*', 'table']]
                      - !Join ['', [!Sub '${StackName}', '*']]

Am I missing some Role configuration?

Thank you.

How did you use this role? Did you pass it in when you created the stack? — cementblocks
When you create a stack you can specify a role arn for cloudformation to use when creating/updating/deleting resources. That role cannot of course be created by the stack. — cementblocks

cementblocks cementblocks · Accepted Answer · 2019-01-31T15:03:11

You can use a DeletionPolicy of RETAIN to prevent the table from being deleted when the stack is removed or table is removed from the template. Also the new UpdateReplacePolicy will prevent CloudFormation from deleting the table when it needs to do so due to primary key changes.

Prevent AWS CloudFormation from deleting DynamoDB using IAM

2 Answers