<a id="cloud-cluster-deletion-protection"></a>

# Cluster Deletion Protection on Confluent Cloud

Cluster deletion protection is an opt-in safeguard that prevents accidental
deletion of a Apache Kafka® cluster through any interface. When enabled, any request
to delete the cluster fails until an authorized user explicitly disables
protection, enforcing a deliberate, two-step deletion process.

Deletion protection helps reduce the risk of:

- Human error
- Misconfigured automation that issues a delete request unintentionally
- Unauthorized or malicious deletion of production clusters

## Requirements

Deletion protection has the following requirements:

- Supported cluster types:
  - Enterprise
  - Dedicated
  - Freight
- Roles that can enable or disable deletion protection:
  - [OrganizationAdmin](../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role)
  - [EnvironmentAdmin](../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role)
  - [CloudClusterAdmin](../security/access-control/rbac/predefined-rbac-roles.md#cloudclusteradmin-role)

## Considerations

Before you enable deletion protection, consider the following:

- Deletion protection is disabled by default for new clusters. You must enable
  it.
- You set deletion protection on individual clusters. You cannot apply it at the
  environment or organization level.
- Deletion protection prevents only delete operations. You can make
  configuration updates—such as renaming or resizing the cluster, updating
  the uptime SLA, and changing network settings—while protection is enabled.
- If a cluster has deletion protection enabled, you cannot delete the
  environment that contains the cluster until you disable protection on that
  cluster. For more information, see [How deletion protection blocks environment deletion](#cluster-deletion-protection-cascade).

## How deletion protection impacts cluster operations

When you enable deletion protection on a cluster, expect the following:

- Billing continues on protected clusters: Protection prevents deletion, not
  charges. You are billed for a cluster until you disable protection and delete
  that cluster.
- Terraform deletion is a multi-step workflow: To delete a protected cluster with
  Terraform, you disable protection, run `terraform apply`, and then run
  `terraform destroy`. For more information, see
  [Disable deletion protection](#cluster-deletion-protection-disable).
- Automation must handle rejected deletes: A script or pipeline that issues a
  cluster `DELETE` must expect the request to fail while protection is
  enabled. For more information, see [Delete attempts on a protected cluster](#cluster-deletion-protection-blocked).
- No partial deletion: If any cluster in an environment has deletion
  protection enabled, the environment cannot be deleted, and its other clusters
  are retained as well. For more information, see
  [How deletion protection blocks environment deletion](#cluster-deletion-protection-cascade).

<a id="cluster-deletion-protection-enable"></a>

## Enable deletion protection

You can enable deletion protection on a new cluster when you create it or on an
existing cluster.

#### NOTE
Deletion protection is not supported on Basic or Standard
clusters.

### Cloud Console

To enable deletion protection on an existing cluster:

1. Navigate to the clusters page for your environment.
2. Select **Cluster Settings**.
3. In **Deletion protection**, click the edit icon, select **Enabled**,
   and click **Save changes**.

### Confluent CLI

Enable deletion protection when you create a cluster:

```none
confluent kafka cluster create <name> --cloud <cloud> --region <region> --type <type> --deletion-protection=true
```

For example:

```none
confluent kafka cluster create my-cluster --cloud aws --region us-east-1 --type enterprise --deletion-protection=true
```

Enable deletion protection on an existing cluster:

```none
confluent kafka cluster update <id> --deletion-protection=true
```

### Confluent Cloud APIs

To enable deletion protection at create time, include
`deletion_protection: true` in the `spec` of your
`POST /cmk/v2/clusters` request:

```text
POST /cmk/v2/clusters HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "display_name": "ProdKafkaCluster",
      "availability": "High",
      "cloud": "AWS",
      "region": "us-east-1",
      "config": {
         "kind": "Enterprise"
      },
      "deletion_protection": true,
      "environment": {
         "id": "env-a12b34"
      }
   }
}
```

To enable deletion protection on an existing cluster, send a `PATCH`
request that sets `spec.deletion_protection` to `true`:

```text
PATCH /cmk/v2/clusters/{id}?environment={environment_id} HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "deletion_protection": true,
      "environment": {
         "id": "env-a12b34"
      }
   }
}
```

### Terraform

#### NOTE
The Confluent Cloud API enforces `deletion_protection` across every
interface. The Terraform `lifecycle { prevent_destroy = true }`
meta-argument only blocks a destroy run through the Terraform
configuration that sets it. You can still delete the cluster through
another interface or from a different Terraform configuration. Use both
for layered protection.

Set `deletion_protection = true` in the
[confluent_kafka_cluster](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_kafka_cluster)
resource:

```terraform
resource "confluent_kafka_cluster" "prod" {
  display_name        = "prod-cluster"
  availability        = "MULTI_ZONE"
  cloud               = "AWS"
  region              = "us-east-1"
  deletion_protection = true

  enterprise {}

  environment {
    id = data.confluent_environment.test_env.id
  }
}
```

<a id="cluster-deletion-protection-view"></a>

## View deletion protection status

### Cloud Console

1. Navigate to the clusters page for your environment.
2. Select **Cluster Settings**.
3. In **Deletion protection**, view the current state (**Enabled** or
   **Disabled**).

### Confluent CLI

Describe the cluster to view the **Deletion Protection** field:

```none
confluent kafka cluster describe <id>
```

Your output should resemble the following:

```text
+----------------------+---------------------------+
| ID                   | lkc-123exa                |
| Name                 | prod-cluster              |
| Type                 | ENTERPRISE                |
| ...                  | ...                       |
| Deletion Protection  | true                      |
+----------------------+---------------------------+
```

### Confluent Cloud APIs

The current value is returned in `spec.deletion_protection` on a
`GET /cmk/v2/clusters/{id}` response.

### Terraform

For the current protection state, check the `deletion_protection`
attribute. It is available on:

- Resource: [confluent_kafka_cluster (resource)](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_kafka_cluster)
- Data sources: [confluent_kafka_cluster (data source)](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/data-sources/confluent_kafka_cluster) and
  [confluent_kafka_clusters](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/data-sources/confluent_kafka_clusters)

<a id="cluster-deletion-protection-disable"></a>

## Disable deletion protection

Disabling deletion protection is a separate operation from deleting the
cluster. You must disable protection first and then issue a delete request.

### Cloud Console

1. Navigate to the clusters page for your environment.
2. Select **Cluster Settings**.
3. In **Deletion protection**, click the edit icon, select
   **Disabled**, and click **Save changes**.

### Confluent CLI

Disable deletion protection on a cluster:

```none
confluent kafka cluster update <id> --deletion-protection=false
```

### Confluent Cloud APIs

Send a `PATCH` request that sets `spec.deletion_protection` to
`false`:

```text
PATCH /cmk/v2/clusters/{id}?environment={environment_id} HTTP/1.1
Host: api.confluent.cloud

{
   "spec": {
      "deletion_protection": false,
      "environment": {
         "id": "env-a12b34"
      }
   }
}
```

### Terraform

Set `deletion_protection = false` on the `confluent_kafka_cluster`
resource and apply the change before applying a destroy plan:

```terraform
resource "confluent_kafka_cluster" "prod" {
  # ...
  deletion_protection = false
}
```

<a id="cluster-deletion-protection-blocked"></a>

## Delete attempts on a protected cluster

When deletion protection is enabled, any delete request through the
Confluent Cloud Console, Confluent CLI, REST API, or Terraform is rejected. To
delete the cluster, first [disable deletion protection](#cluster-deletion-protection-disable), and then delete the cluster.

### Cloud Console

The **Delete cluster** control is unavailable while deletion protection
is enabled, and the **Cluster Settings** page indicates that protection
must be disabled first.

### Confluent CLI

Attempting to delete a protected cluster returns an error:

```text
Error: failed to delete <cluster-id>: Cluster deletion is blocked by deletion protection.

Suggestions:
    Disable deletion_protection before deleting the cluster.
```

### Confluent Cloud APIs

A `DELETE /cmk/v2/clusters/{id}` request against a protected cluster
returns an HTTP `409 Conflict` response with an error indicating that
deletion protection is enabled:

```json
{
  "errors": [
    {
      "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "status": "409",
      "code": "deletion_protection_enabled",
      "detail": "Cluster deletion is blocked by deletion protection.",
      "source": {}
    }
  ]
}
```

### Terraform

Terraform `plan` and `apply` for a destroy of a protected cluster
fail with a validation error:

```text
Error: Cluster deletion is blocked by deletion protection.
Disable deletion_protection before deleting the cluster.
```

<a id="cluster-deletion-protection-cascade"></a>

## How deletion protection blocks environment deletion

Deletion protection at the cluster level also blocks deletion of the
containing environment.

In this case, environment deletion fails and no clusters in that environment
are deleted, including unprotected clusters. The error message indicates that
deletion protection is preventing the deletion, but doesn’t list the specific
clusters.

To find the clusters that are blocking the deletion, check the deletion
protection status of each cluster in the environment. To check this status,
see [View deletion protection status](#cluster-deletion-protection-view). Disable deletion protection on
each blocking cluster and then retry the environment deletion.

Propagating a cluster’s deletion protection status to the environment level
is *eventually consistent*, meaning there might be a short delay between when
you enable protection on a cluster and when an environment deletion check
reflects that status. You can check the propagation status in the
**Settings** tab of the **Environment overview** page in the
Confluent Cloud Console.

#### WARNING
If you delete an environment before deletion protection propagates to the
environment level, or if an environment deletion is already in progress
when you enable protection on a cluster in that environment, the
protection might not be honored and the cluster is deleted along with the
environment. Enable deletion protection well before you start an
environment deletion.

<a id="cluster-deletion-protection-audit"></a>

## Audit log entries for blocked deletion attempts

When deletion protection blocks a delete attempt, the operation is recorded in
an audit log event. Key fields in the event include:

- `data.methodName`: `DeleteKafkaCluster` for a cluster deletion, or
  `DeleteEnvironment` for an environment deletion.
- `data.result.status`: `FAILURE`.
- `data.authenticationInfo.principal`: The principal that attempted the
  deletion.
- `data.resourceName`: The resource that the delete request targeted.

For environment deletions, the error does not identify the specific protected
clusters.

For event schemas and example payloads, see
[DeleteKafkaCluster](../monitoring/audit-logging/event-methods/organization-events.md#deletekafkacluster-examples) and
[DeleteEnvironment](../monitoring/audit-logging/event-methods/organization-events.md#deleteenvironment-examples).

## Related content

- [Create a Kafka Cluster](create-cluster.md#cloud-create-cluster)
- [Delete an environment](../security/access-control/hierarchy/cloud-environments.md#cloud-environment-delete)
- [Predefined RBAC roles in Confluent Cloud](../security/access-control/rbac/predefined-rbac-roles.md#cloud-rbac-roles)