ELB.6: Load balancers can be deleted by accident

What does AWS Security Hub ELB.6 check?

ELB.6 fails when an Application, Gateway, or Network Load Balancer has the deletion_protection.enabled attribute set to false. With protection off, a single DeleteLoadBalancer call removes the load balancer instantly.

Why does ELB.6 matter?

A load balancer is the front door to a whole tier of services. A misfired terraform destroy, a fat-fingered console click or an over-broad IAM policy can delete it in under a second, and the Route 53 alias then points at nothing until something is rebuilt; every in-flight request fails for the duration. Deletion protection forces a deliberate two-step before the resource can go, turning an instant outage into a blocked action.

How do I fix ELB.6?

1. Audit load balancers and check deletion_protection.enabled across the account.
2. Set it to true with modify-load-balancer-attributes on production resources.
3. Default the attribute on in your IaC, and back it with an SCP or Config rule so it cannot be silently turned off.
4. Remember the flag must be cleared deliberately before a legitimate decommission.

# Enable deletion protection on every unprotected standalone RDS instance in a region.
for id in $(aws rds describe-db-instances \
  --query 'DBInstances[?DeletionProtection==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --deletion-protection --apply-immediately
  echo "Protected RDS instance: $id"
done

# Termination-protect every production-tagged CloudFormation stack (eyeball the list first).
aws cloudformation describe-stacks \
  --query "Stacks[?Tags[?Key=='Environment' && Value=='production']].StackName" \
  --output text | tr '\t' '\n' | while read -r stack; do
  aws cloudformation update-termination-protection \
    --stack-name "$stack" --enable-termination-protection
  echo "Protected stack: $stack"
done

# Deletion-protect a production load balancer.
aws elbv2 modify-load-balancer-attributes --load-balancer-arn "$LB_ARN" \
  --attributes Key=deletion_protection.enabled,Value=true