Cloud Resource Protection Mechanisms

# Enable termination protection on existing instances
aws ec2 modify-instance-attribute \
  --instance-id i-0abc123def456 \
  --disable-api-termination

# Enable at launch time via Terraform
resource "aws_instance" "production" {
  ami                     = "ami-0abcdef1234567890"
  instance_type           = "m6i.xlarge"
  disable_api_termination = true

  tags = {
    Name        = "production-web-server"
    Environment = "production"
    Protected   = "true"
  }
}

# Enable on existing database
aws rds modify-db-instance \
  --db-instance-identifier prod-database \
  --deletion-protection \
  --apply-immediately

# Terraform configuration
resource "aws_rds_instance" "production" {
  identifier          = "prod-database"
  engine              = "postgres"
  instance_class      = "db.r6g.xlarge"
  deletion_protection = true

  lifecycle {
    prevent_destroy = true
  }
}

# Create bucket with Object Lock enabled (must be set at creation)
aws s3api create-bucket \
  --bucket critical-backups \
  --object-lock-enabled-for-bucket

# Set default retention policy (Governance mode - admin can override)
aws s3api put-object-lock-configuration \
  --bucket critical-backups \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "GOVERNANCE",
        "Days": 90
      }
    }
  }'

# Compliance mode - NOBODY can delete, not even root
# Use for regulatory requirements
aws s3api put-object-lock-configuration \
  --bucket regulatory-data \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Days": 2555
      }
    }
  }'

# Lock an entire resource group against deletion
az lock create \
  --name "protect-production" \
  --resource-group production-rg \
  --lock-type CanNotDelete \
  --notes "AI agent safety: prevent accidental resource group deletion"

# Lock a specific resource as read-only
az lock create \
  --name "protect-prod-db" \
  --resource-group production-rg \
  --resource-name prod-sql-server \
  --resource-type Microsoft.Sql/servers \
  --lock-type ReadOnly

# Lock at subscription level (protects everything)
az lock create \
  --name "subscription-delete-lock" \
  --lock-type CanNotDelete \
  --notes "Subscription-wide deletion protection"

# Create a lien to prevent project deletion
gcloud alpha resource-manager liens create \
  --project=production-project \
  --restrictions=resourcemanager.projects.delete \
  --reason="Production project - deletion blocked for AI agent safety"

# Enable deletion protection on a Compute Engine instance
gcloud compute instances update prod-web-server \
  --zone=us-central1-a \
  --deletion-protection

# Enable deletion protection on a Cloud SQL instance
gcloud sql instances patch prod-database \
  --deletion-protection

# Standard tags for all critical resources:
tags = {
  Environment       = "production"          # production, staging, development
  CriticalityLevel  = "high"                # high, medium, low
  DeletionProtected = "true"                # Indicates protection is enabled
  Owner             = "platform-team"       # Team responsible
  AgentAccess       = "read-only"           # What AI agents are allowed to do
  BackupRetention   = "90-days"             # How long backups are kept
  LastReviewDate    = "2026-03-15"          # When protection was last reviewed
}