Back to Checks
aws

ELBv2 load balancer has deletion protection enabled

elbv2_deletion_protection
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbv2LoadBalancer

ELBv2 load balancers with deletion protection (deletion_protection.enabled) are resistant to deletion through standard APIs.

The assessment determines whether this attribute is enabled on each load balancer.

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, a user or automated process can delete the load balancer, cutting off service endpoints and breaking routing, harming availability.

Malicious or mistaken deletes enable DoS, disrupt blue/green rollbacks, and increase incident recovery time.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_deletion_protection

Recommendation

Enable deletion protection for production and other critical load balancers.

Enforce least privilege to restrict delete actions, apply governance (tags and policy guardrails) for protected assets, and require change control with approvals. For pipelines, add checks that block deletion of protected resources.

Remediation

CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb_arn> --attributes Key=deletion_protection.enabled,Value=true

Terraform

resource "aws_lb" "<example_resource_name>" {
  subnets = ["<example_subnet_id_1>", "<example_subnet_id_2>"]

  enable_deletion_protection = true # Critical: enables deletion protection to pass the check
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <example_subnet_id_1>
        - <example_subnet_id_2>
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled  # Critical: enable deletion protection
          Value: "true"                   # Ensures the LB cannot be deleted accidentally

Other

1In the AWS Console, go to EC2 > Load Balancers (under Load Balancing)
2Select the target load balancer
3Open the Attributes tab and click Edit attributes
4Enable Deletion protection
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_deletion_protection(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = (
                f"ELBv2 {lb.name} does not have deletion protection enabled."
            )
            if lb.deletion_protection == "true":
                report.status = "PASS"
                report.status_extended = (
                    f"ELBv2 {lb.name} has deletion protection enabled."
                )

            findings.append(report)

        return findings

References