diff --git a/touchdown/aws/common.py b/touchdown/aws/common.py
index 2e7602abaa..9105cfa786 100644
--- a/touchdown/aws/common.py
+++ b/touchdown/aws/common.py
@@ -568,6 +568,10 @@ def can_delete(self):
     def get_actions(self):
         self.object = self.describe_object()
 
+        if 'never-destroy' in self.resource.ensure:
+            logger.debug('Resource "{}" not considered for deletion due to ensure policy'.format(resource))
+            return
+
         if not self.object:
             logger.debug('Resource "{}" not found - assuming already destroyed'.format(self.resource))
             return
diff --git a/touchdown/goals/destroy.py b/touchdown/goals/destroy.py
index 828c422f43..b70aaf12e1 100644
--- a/touchdown/goals/destroy.py
+++ b/touchdown/goals/destroy.py
@@ -24,9 +24,7 @@ class Destroy(ActionGoalMixin, Goal):
     execute_in_reverse = True
 
     def get_plan_class(self, resource):
-        if 'never-destroy' not in resource.ensure:
-            return resource.meta.get_plan('destroy') or resource.meta.get_plan('describe') or resource.meta.get_plan('null')
-        return resource.meta.get_plan('describe') or resource.meta.get_plan('null')
+        return resource.meta.get_plan('destroy') or resource.meta.get_plan('describe') or resource.meta.get_plan('null')
 
 
 register(Destroy)
diff --git a/touchdown/tests/test_aws_s3_bucket.py b/touchdown/tests/test_aws_s3_bucket.py
index 6dcb1294cc..c6240dd47e 100644
--- a/touchdown/tests/test_aws_s3_bucket.py
+++ b/touchdown/tests/test_aws_s3_bucket.py
@@ -82,6 +82,49 @@ def test_create_bucket_idempotent(self):
 
 class TestBucketDeletion(StubberTestCase):
 
+    def test_delete_bucket_forbidden(self):
+        # If a bucket is marked as never-destroy then it's destroy plan is
+        # still used, but it should never harm it
+        goal = self.create_goal('destroy')
+
+        bucket = self.fixtures.enter_context(BucketStubber(
+            goal.get_service(
+                self.aws.add_bucket(
+                    name='my-bucket',
+                    ensure=['never-destroy'],
+                ),
+                'destroy',
+            )
+        ))
+
+        bucket.add_list_buckets_one_response()
+        bucket.add_head_bucket()
+        bucket.add_get_bucket_location()
+        bucket.add_get_bucket_cors()
+        bucket.add_get_bucket_policy()
+        bucket.add_get_bucket_notification_configuration()
+        bucket.add_get_bucket_accelerate_configuration()
+
+        self.assertRaises(errors.NothingChanged, goal.execute)
+
+    def test_delete_bucket_forbidden_not_found(self):
+        # If a bucket is marked as never-destroy then it's destroy plan is
+        # still used, but it should never harm it
+        goal = self.create_goal('destroy')
+
+        bucket = self.fixtures.enter_context(BucketStubber(
+            goal.get_service(
+                self.aws.add_bucket(
+                    name='my-bucket',
+                    ensure=['never-destroy'],
+                ),
+                'destroy',
+            )
+        ))
+        bucket.add_list_buckets_empty_response()
+
+        self.assertRaises(errors.NothingChanged, goal.execute)
+
     def test_delete_bucket(self):
         goal = self.create_goal('destroy')