CloudFormation DeletionPolicy: Retain S3 Buckets When Stack Is Deleted
A DevOps engineer is writing an AWS CloudFormation template that creates an Amazon S3 bucket with versioning enabled. The engineer wants to ensure that the bucket cannot be deleted accidentally. What should the engineer add to the template?
Quick Answer
The answer is to set the DeletionPolicy attribute to Retain on the S3 bucket resource. This configuration overrides CloudFormation’s default behavior, which deletes all resources when a stack is removed, by instructing the service to preserve the bucket and its versioned objects even after the stack deletion. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding of resource lifecycle management within CloudFormation, specifically how to prevent accidental deletion of stateful resources like S3 buckets. A common trap is confusing DeletionPolicy with stack policies or IAM permissions, but the key distinction is that DeletionPolicy is a resource-level attribute that directly controls what happens during stack deletion. Remember the mnemonic: "Retain to remain" — if you want the bucket to stay, set Retain.
⚠ Common exam trap
Candidates often confuse termination protection (an EC2 feature) with CloudFormation's DeletionPolicy, or mistakenly believe a bucket policy can override CloudFormation's resource deletion behavior during stack teardown.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the DeletionPolicy attribute to Retain on the S3 bucket resource
Setting the DeletionPolicy attribute to Retain on the S3 bucket resource ensures that when the CloudFormation stack is deleted, the bucket is preserved and not removed. This is the correct AWS CloudFormation mechanism to prevent accidental deletion of a resource, as it overrides the default behavior of deleting all resources when a stack is deleted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the DeletionPolicy attribute to Retain on the S3 bucket resource
Why this is correct
DeletionPolicy: Retain prevents the bucket from being deleted when the stack is deleted.
- ✗
Enable termination protection on the S3 bucket
Why it's wrong here
Termination protection is an EC2 feature.
- ✗
Add a DependsOn clause to the bucket referencing the stack itself
Why it's wrong here
DependsOn does not affect deletion behavior.
- ✗
A bucket policy that denies s3:DeleteBucket
Why it's wrong here
Bucket policy controls permissions, not stack deletion behavior.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?
medium- A.The bucket is deleted because the stack deletion overrides the DeletionPolicy.
- ✓ B.The bucket is retained (not deleted) after the stack deletion.
- C.The stack deletion fails because the bucket has versioning enabled.
- D.The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.
Why B: The DeletionPolicy attribute with a value of 'Retain' explicitly instructs AWS CloudFormation to preserve the S3 bucket when the stack is deleted. Even though stack deletion normally removes all resources, the DeletionPolicy overrides this default behavior, so the bucket remains in the AWS account. The engineer will find the bucket still exists after the stack is deleted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.