Skip to main content

🛡️ AWS ELB Load Balancer Deletion Protection is disabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies Application, Network, and Gateway Load Balancers that do not have deletion protection enabled.

Deletion Protection should be enabled for all ELBv2 load balancers to help prevent accidental deletion and unintended service disruption.

Rationale​

Load balancers often serve as the primary entry point for application traffic. Accidental deletion can result in immediate and complete service outages for dependent applications. Even in environments managed through automation or Infrastructure as Code (IaC), manual actions performed through the AWS Management Console or AWS CLI can introduce human error.

Enabling Deletion Protection adds an explicit safeguard by requiring an additional verification step before a load balancer can be deleted, helping ensure that critical infrastructure is not decommissioned unintentionally.

Audit​

This policy flags an AWS ELB load Balancer as INCOMPLIANT if the Additional Attributes include deletion_protection.enabled: false.

Classic Load Balancers are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Enable Deletion Protection for an Elastic Load Balancer​

Deletion Protection helps prevent accidental removal of critical load balancing resources and reduces the risk of unintended service outages.

From Command Line​

Run the following command to update the load balancer attributes and enable Deletion Protection:

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn {{load-balancer-arn}} \
    --attributes Key=deletion_protection.enabled,Value=true

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled1no data
💼 Cloudaware Framework → 💼 System Configuration69no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP High Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)441no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)224no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events178no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events179no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked49no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency22no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81741no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy24no data