ELBv2 load balancer has deletion protection enabled

Check ID: elbv2_deletion_protection
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbv2LoadBalancer

What this check verifies

ELBv2 load balancers with deletion protection (deletion_protection.enabled) are resistant to deletion through standard APIs. The assessment determines whether this attribute is enabled on each load balancer.

Risk

Without deletion protection, a user or automated process can delete the load balancer, cutting off service endpoints and breaking routing, harming availability. Malicious or mistaken deletes enable DoS, disrupt blue/green rollbacks, and increase incident recovery time.

Recommendation

Enable deletion protection for production and other critical load balancers. Enforce least privilege to restrict delete actions, apply governance (tags and policy guardrails) for protected assets, and require change control with approvals. For pipelines, add checks that block deletion of protected resources.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb_arn> --attributes Key=deletion_protection.enabled,Value=true

resource "aws_lb" "<example_resource_name>" {
  subnets = ["<example_subnet_id_1>", "<example_subnet_id_2>"]

  enable_deletion_protection = true # Critical: enables deletion protection to pass the check
}

Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <example_subnet_id_1>
        - <example_subnet_id_2>
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled  # Critical: enable deletion protection
          Value: "true"                   # Ensures the LB cannot be deleted accidentally

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ELBv2 load balancer has cross-zone balancing enabled Application Load Balancer mitigates desync attacks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires