Cluster Deletion Protection on Confluent Cloud

Cluster deletion protection is an opt-in safeguard that prevents accidental deletion of a Kafka cluster through any interface. When enabled, any request to delete the cluster fails until an authorized user explicitly disables protection, enforcing a deliberate, two-step deletion process.

Deletion protection helps reduce the risk of:

  • Human error

  • Misconfigured automation that issues a delete request unintentionally

  • Unauthorized or malicious deletion of production clusters

Requirements

Deletion protection has the following requirements:

Considerations

Before you enable deletion protection, consider the following:

  • Deletion protection is disabled by default for new clusters. You must enable it.

  • You set deletion protection on individual clusters. You cannot apply it at the environment or organization level.

  • Deletion protection prevents only delete operations. You can make configuration updates—such as renaming or resizing the cluster, updating the uptime SLA, and changing network settings—while protection is enabled.

  • If a cluster has deletion protection enabled, you cannot delete the environment that contains the cluster until you disable protection on that cluster. For more information, see How deletion protection blocks environment deletion.

How deletion protection impacts cluster operations

When you enable deletion protection on a cluster, expect the following:

  • Billing continues on protected clusters: Protection prevents deletion, not charges. You are billed for a cluster until you disable protection and delete that cluster.

  • Terraform deletion is a multi-step workflow: To delete a protected cluster with Terraform, you disable protection, run terraform apply, and then run terraform destroy. For more information, see Disable deletion protection.

  • Automation must handle rejected deletes: A script or pipeline that issues a cluster DELETE must expect the request to fail while protection is enabled. For more information, see Delete attempts on a protected cluster.

  • No partial deletion: If any cluster in an environment has deletion protection enabled, the environment cannot be deleted, and its other clusters are retained as well. For more information, see How deletion protection blocks environment deletion.

Enable deletion protection

You can enable deletion protection on a new cluster at create time or on an existing cluster.

Note

Deletion protection is not supported on Basic or Standard clusters.

To enable deletion protection on an existing cluster:

  1. Navigate to the clusters page for your environment.

  2. Select Cluster Settings.

  3. In Deletion protection, click the edit icon, select Enabled, and click Save changes.

Enable deletion protection when you create a cluster:

confluent kafka cluster create <name> --cloud <cloud> --region <region> --type <type> --deletion-protection=true

For example:

confluent kafka cluster create my-cluster --cloud aws --region us-east-1 --type enterprise --deletion-protection=true

Enable deletion protection on an existing cluster:

confluent kafka cluster update <id> --deletion-protection=true

To enable deletion protection at create time, include deletion_protection: true in the spec of your POST /cmk/v2/clusters request:

POST /cmk/v2/clusters HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "display_name": "ProdKafkaCluster",
      "availability": "High",
      "cloud": "AWS",
      "region": "us-east-1",
      "config": {
         "kind": "Enterprise"
      },
      "deletion_protection": true,
      "environment": {
         "id": "env-a12b34"
      }
   }
}

To enable deletion protection on an existing cluster, send a PATCH request that sets spec.deletion_protection to true:

PATCH /cmk/v2/clusters/{id}?environment={environment_id} HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "deletion_protection": true,
      "environment": {
         "id": "env-a12b34"
      }
   }
}

Note

The Confluent Cloud API enforces deletion_protection across every interface. The Terraform lifecycle { prevent_destroy = true } meta-argument only blocks a destroy run through the Terraform configuration that sets it. You can still delete the cluster through another interface or from a different Terraform configuration. Use both for layered protection.

Set deletion_protection = true in the confluent_kafka_cluster resource:

resource "confluent_kafka_cluster" "prod" {
  display_name        = "prod-cluster"
  availability        = "MULTI_ZONE"
  cloud               = "AWS"
  region              = "us-east-1"
  deletion_protection = true

  enterprise {}

  environment {
    id = data.confluent_environment.test_env.id
  }
}

View deletion protection status

  1. Navigate to the clusters page for your environment.

  2. Select Cluster Settings.

  3. In Deletion protection, view the current state (Enabled or Disabled).

Describe the cluster to view the Deletion Protection field:

confluent kafka cluster describe <id>

Your output should resemble the following:

+----------------------+---------------------------+
| ID                   | lkc-123exa                |
| Name                 | prod-cluster              |
| Type                 | ENTERPRISE                |
| ...                  | ...                       |
| Deletion Protection  | true                      |
+----------------------+---------------------------+

The current value is returned in spec.deletion_protection on a GET /cmk/v2/clusters/{id} response.

For the current protection state, check the deletion_protection attribute. It is available on:

Disable deletion protection

Disabling deletion protection is a separate operation from deleting the cluster. You must disable protection first and then issue a delete request.

  1. Navigate to the clusters page for your environment.

  2. Select Cluster Settings.

  3. In Deletion protection, click the edit icon, select Disabled, and click Save changes.

Disable deletion protection on a cluster:

confluent kafka cluster update <id> --deletion-protection=false

Send a PATCH request that sets spec.deletion_protection to false:

PATCH /cmk/v2/clusters/{id}?environment={environment_id} HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "deletion_protection": false,
      "environment": {
         "id": "env-a12b34"
      }
   }
}

Set deletion_protection = false on the confluent_kafka_cluster resource and apply the change before applying a destroy plan:

resource "confluent_kafka_cluster" "prod" {
  # ...
  deletion_protection = false
}

Delete attempts on a protected cluster

When deletion protection is enabled, any delete request through the Confluent Cloud Console, Confluent CLI, REST API, or Terraform is rejected. To delete the cluster, first disable deletion protection, and then delete the cluster.

The Delete cluster control is unavailable while deletion protection is enabled, and the Cluster Settings page indicates that protection must be disabled first.

Attempting to delete a protected cluster returns an error:

Error: failed to delete <cluster-id>: Cluster deletion is blocked by deletion protection.

Suggestions:
    Disable deletion_protection before deleting the cluster.

A DELETE /cmk/v2/clusters/{id} request against a protected cluster returns an HTTP 409 Conflict response with an error indicating that deletion protection is enabled:

{
  "errors": [
    {
      "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "status": "409",
      "code": "deletion_protection_enabled",
      "detail": "Cluster deletion is blocked by deletion protection.",
      "source": {}
    }
  ]
}

Terraform plan and apply for a destroy of a protected cluster fail with a validation error:

Error: Cluster deletion is blocked by deletion protection.
Disable deletion_protection before deleting the cluster.

How deletion protection blocks environment deletion

Deletion protection at the cluster level also blocks deletion of the containing environment.

In this case, environment deletion fails and no clusters in that environment are deleted, including unprotected clusters. The error message indicates that deletion protection is preventing the deletion, but doesn’t list the specific clusters.

To find the clusters that are blocking the deletion, check the deletion protection status of each cluster in the environment. To check this status, see View deletion protection status. Disable deletion protection on each blocking cluster and then retry the environment deletion.

Warning

If an environment deletion is already in progress when you enable deletion protection on a cluster in that environment, the protection is ignored and the cluster is deleted along with the environment. Enable deletion protection before you start an environment deletion.

Audit log entries for blocked deletion attempts

When deletion protection blocks a delete attempt, the operation is recorded in an audit log event. Key fields in the event include:

  • data.methodName: DeleteKafkaCluster for a cluster deletion, or DeleteEnvironment for an environment deletion.

  • data.result.status: FAILURE.

  • data.authenticationInfo.principal: The principal that attempted the deletion.

  • data.resourceName: The resource that the delete request targeted.

For environment deletions, the error does not identify the specific protected clusters.

For event schemas and example payloads, see DeleteKafkaCluster and DeleteEnvironment.

Related content