Abstract: A customer's resources are protected from malicious or accidental deletion or termination. In some embodiments anomaly detection is used for identifying suspicious activities, which is combined with options to restore previously deleted resources. To define and detect anomalies, resource profiles are generated indicative of how resources are being used, and user profiles of how users use resources of the compute service provider. Instead of immediately deleting a resource, a temporary marker can be placed on the resource. The temporary marker blocks attempts to access the resource just as if the resource was deleted. However, the resource can easily be recovered by simply removing the marker. When a deletion event is identified as anomalous, an alert is generated to the customer. Upon receiving the alert, customers can opt to restore the resource that has been deleted, which will remove the marker.