Project: KICS (Provisioning / Security & Compliance)
File: afecd1f1-6378-4f7e-bb3b-60c35801fdd4.md

title: ALB Deletion Protection Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: afecd1f1-6378-4f7e-bb3b-60c35801fdd4 Query name: ALB Deletion Protection Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Application Load Balancer should have deletion protection enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="7" resource "aws_alb" "positive1" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id enabledeletionprotection = false tags = { Environment = "production" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "aws_alb" "positive2" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id tags = { Environment = "production" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="7" resource "aws_lb" "positive3" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id enabledeletionprotection = false tags = { Environment = "production" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="1" resource "aws_lb" "positive4" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id tags = { Environment = "production" } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="9" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~>

name = "my-alb" loadbalancertype = "application" enabledeletionprotection = false vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="1" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" loadbalancertype = "application" vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "aws_alb" "negative1" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id enabledeletionprotection = true tags = { Environment = "production" } } ``` ```tf title="Negative test num. 2 - tf file" resource "aws_lb" "negative2" { name = "test-lb-tf" internal = false loadbalancertype = "network" subnets = aws_subnet.public.*.id enabledeletionprotection = true tags = { Environment = "production" } } ``` ```tf title="Negative test num. 3 - tf file" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" loadbalancertype = "application" enabledeletionprotection = true vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ```