This is a very nice feature, and I'm going to take a close look at Terraform. If you are already using cloudformation, I'd recommend applying stack policies tha

This is a very nice feature, and I'm going to take a close look at Terraform. If you are already using cloudformation, I'd recommend applying stack policies that deny permission to "Update:Replace" or "Update:Delete" any resources. When you need to, you can use a one-time policy that lets you blow away specific resources, by name or type. http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuid...