Elb no deletion policy remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using the AWS console:

Open the AWS Management Console and navigate to the EC2 service.
From the navigation pane, click on the “Load Balancers” option.
Select the ELB that you want to remediate and click on its name to open its details page.
In the “Attributes” section of the details page, locate the “Deletion Protection” option and click on the “Edit” button next to it.
Select the checkbox next to “Enable deletion protection” and click on the “Save” button to enable deletion protection for the ELB.
Once the deletion protection is enabled, you will see a lock icon next to the ELB name indicating that it is protected from accidental deletion.
Repeat the above steps for all the ELBs that need to be remediated.

By following the above steps, you can easily remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using the AWS console.

Using CLI

To remediate the misconfiguration of ELBs not having deletion protection flag enabled, you can follow the below steps:

Open your AWS CLI and run the following command to enable deletion protection on all your ELBs:

aws elb modify-load-balancer-attributes --load-balancer-name <ELB_NAME> --attributes "{\"DeletionProtection\":{\"Value\":true}}"

Note: Replace <ELB_NAME> with the name of the ELB that you want to enable deletion protection for.

To verify that the deletion protection flag is enabled, run the following command:

aws elb describe-load-balancers --load-balancer-name <ELB_NAME> --query 'LoadBalancerDescriptions[*].[LoadBalancerName, Scheme, DeletionProtection]'

Note: Replace <ELB_NAME> with the name of the ELB that you want to verify deletion protection for.

If the deletion protection flag is not enabled, repeat step 1 for all the ELBs that you want to enable deletion protection for.

By following these steps, you can remediate the misconfiguration of ELBs not having deletion protection flag enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of ELBs not having deletion protection flag enabled, you can use the following steps in Python:

Import the necessary AWS SDK modules:

import boto3
from botocore.exceptions import ClientError

Initialize a boto3 client for Elastic Load Balancing:

elb_client = boto3.client('elbv2')

Get a list of all the existing ELBs in your AWS account:

try:
    response = elb_client.describe_load_balancers()
    elbs = response['LoadBalancers']
except ClientError as e:
    print(e)

For each ELB, check if the deletion protection flag is enabled. If not, enable it:

for elb in elbs:
    elb_name = elb['LoadBalancerName']
    try:
        response = elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=elb['LoadBalancerArn'],
            Attributes=[
                {
                    'Key': 'deletion_protection.enabled',
                    'Value': 'true'
                }
            ]
        )
        print(f"Deletion protection enabled for ELB {elb_name}")
    except ClientError as e:
        print(e)

Run the Python script to enable deletion protection for all the ELBs in your AWS account.

Note: You will need to have appropriate IAM permissions to modify the load balancer attributes.

Using Terraform

resource "aws_lb" "EXISTING_LOAD_BALANCER" {
  name               = "REPLACE_WITH_LB_NAME"
  internal           = false
  load_balancer_type = "application" # or "network"

  subnets = [
    "REPLACE_WITH_SUBNET_ID_1",
    "REPLACE_WITH_SUBNET_ID_2",
  ]

  # Enable deletion protection to prevent accidental deletion
  enable_deletion_protection = true

  # ...other existing arguments (security_groups, ip_address_type, etc.)...
}

Enabling enable_deletion_protection = true does not force replacement of the load balancer, but it will block deletion until you set it back to false (as per the CLI warning).Verification: terraform plan should show one in-place update on aws_lb.EXISTING_LOAD_BALANCER changing enable_deletion_protection from false (or null) to true.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elb no deletion policy remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation