Use Retain or RetainExceptOnCreate for resources whose data you cannot recreate, Snapshot where the resource supports it and you want a backup on delete, and Delete for disposable resources. With no DeletionPolicy, CloudFormation deletes the resource, except that some RDS resources default to Snapshot.
What each option does
From the AWS template reference:
- Delete. CloudFormation removes the resource and its contents. This is the default. For S3 buckets, all objects must be deleted first or deletion fails.
- Retain. The resource is kept when the stack is deleted, or when it is removed from the template. It continues to exist and incur charges until you delete it. You can use it on any resource type.
- RetainExceptOnCreate. Behaves like Retain, except that if the operation that created the resource is rolled back, CloudFormation deletes it. New, empty resources are cleaned up, while in-use ones are kept.
- Snapshot. For supported resources, CloudFormation takes a snapshot before deleting. Snapshots persist and incur charges until you remove them.
Defaults that surprise people
The default policy is Snapshot for AWS::RDS::DBCluster resources and for AWS::RDS::DBInstance resources that do not set DBClusterIdentifier. Every other resource defaults to Delete.
Resources that support Snapshot include EC2 volumes, ElastiCache clusters and replication groups, DocumentDB and Neptune clusters, RDS clusters and instances, and Redshift clusters.
The replacement trap
DeletionPolicy applies when a stack is deleted or a resource is removed through an update. The documentation says it does not apply to resources whose physical instance is replaced during an update. If you edit a property so that CloudFormation replaces a resource, the old one is deleted, whatever the policy says. A stack policy that denies Update:Replace on that resource closes this gap.
A decision guide
| Resource | Suggested policy |
|---|---|
| Production database | Snapshot or Retain, plus a stack policy against replacement |
| Log bucket with audit data | Retain |
| Encryption key store | Retain |
| Build cache or temp storage | Delete |
| New resource in a risky first deploy | RetainExceptOnCreate |
Using Retain for handover
AWS suggests Retain when you want to modify resources outside CloudFormation and then delete the stack. Otherwise, resources can get out of sync with the template and cause stack errors. Retained resources leave CloudFormation's scope, so tag them with an owner and add them to your inventory, or they become orphans nobody remembers.
Security angles
- Retained buckets and snapshots can hold sensitive data long after the stack is gone. Give them an owner and a review date.
- Snapshots inherit the sensitivity of the source. Check encryption and sharing on them.
- Deleting a stack is a data loss decision, so limit who can do it.
Quick check
Does Retain protect a resource that gets replaced during an update?
No. AWS says the policy does not apply when a resource is replaced during an update. Use a stack policy to block replacement.
What is the default if I set nothing?
Delete, except Snapshot for RDS DBClusters and for DBInstances that do not specify DBClusterIdentifier.
Sources
- DeletionPolicy attribute (AWS CloudFormation Template Reference)
- Prevent updates to stack resources (AWS CloudFormation)
Last reviewed: 19 October 2026.
