Skip to main content

ELBs Should Have Deletion Protection Flag Enabled

More Info:​

Deletion Protection flag should be enabled in order to prevent accidental deletions.

Risk Level​

Low

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using the AWS console:

  1. Open the AWS Management Console and navigate to the EC2 service.

  2. From the navigation pane, click on the "Load Balancers" option.

  3. Select the ELB that you want to remediate and click on its name to open its details page.

  4. In the "Attributes" section of the details page, locate the "Deletion Protection" option and click on the "Edit" button next to it.

  5. Select the checkbox next to "Enable deletion protection" and click on the "Save" button to enable deletion protection for the ELB.

  6. Once the deletion protection is enabled, you will see a lock icon next to the ELB name indicating that it is protected from accidental deletion.

  7. Repeat the above steps for all the ELBs that need to be remediated.

By following the above steps, you can easily remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using the AWS console.

Using CLI

To remediate the misconfiguration of ELBs not having deletion protection flag enabled, you can follow the below steps:

  1. Open your AWS CLI and run the following command to enable deletion protection on all your ELBs:
aws elb modify-load-balancer-attributes --load-balancer-name <ELB_NAME> --attributes "{\"DeletionProtection\":{\"Value\":true}}"

Note: Replace <ELB_NAME> with the name of the ELB that you want to enable deletion protection for.

  1. To verify that the deletion protection flag is enabled, run the following command:
aws elb describe-load-balancers --load-balancer-name <ELB_NAME> --query 'LoadBalancerDescriptions[*].[LoadBalancerName, Scheme, DeletionProtection]'

Note: Replace <ELB_NAME> with the name of the ELB that you want to verify deletion protection for.

  1. If the deletion protection flag is not enabled, repeat step 1 for all the ELBs that you want to enable deletion protection for.

By following these steps, you can remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of ELBs not having deletion protection flag enabled, you can use the following steps in Python:

  1. Import the necessary AWS SDK modules:
import boto3
from botocore.exceptions import ClientError
  1. Initialize a boto3 client for Elastic Load Balancing:
elb_client = boto3.client('elbv2')
  1. Get a list of all the existing ELBs in your AWS account:
try:
    response = elb_client.describe_load_balancers()
    elbs = response['LoadBalancers']
except ClientError as e:
    print(e)
  1. For each ELB, check if the deletion protection flag is enabled. If not, enable it:
for elb in elbs:
    elb_name = elb['LoadBalancerName']
    try:
        response = elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=elb['LoadBalancerArn'],
            Attributes=[
                {
                    'Key': 'deletion_protection.enabled',
                    'Value': 'true'
                }
            ]
        )
        print(f"Deletion protection enabled for ELB {elb_name}")
    except ClientError as e:
        print(e)
  1. Run the Python script to enable deletion protection for all the ELBs in your AWS account.

Note: You will need to have appropriate IAM permissions to modify the load balancer attributes.

Using Terraform
resource "aws_lb" "EXISTING_LOAD_BALANCER" {
  name               = "REPLACE_WITH_LB_NAME"
  internal           = false
  load_balancer_type = "application" # or "network"

  subnets = [
    "REPLACE_WITH_SUBNET_ID_1",
    "REPLACE_WITH_SUBNET_ID_2",
  ]

  # Enable deletion protection to prevent accidental deletion
  enable_deletion_protection = true

  # ...other existing arguments (security_groups, ip_address_type, etc.)...
}

Enabling enable_deletion_protection = true does not force replacement of the load balancer, but it will block deletion until you set it back to false (as per the CLI warning).

Verification: terraform plan should show one in-place update on aws_lb.EXISTING_LOAD_BALANCER changing enable_deletion_protection from false (or null) to true.

Additional Reading:​