Skip to main content

Lack of protection against deletion - ELB

Description

The current configuration of Elastic Load Balancing has no Deletion Protection safety feature enabled.

Impact

  • AWS load balancers can be accidentally deleted.
  • Load-balanced environments remain unsafe.
  • Intentional or accidental deletion of data integrity.

Recommendation

Check the Deletion Protection configuration attribute value inside attributes section and enable it.

Threat

Attacker with access to the AWS console that modifies or deletes information.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: N
  • Availability: H

Temporal

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  • Score:
    • Base: 4.9
    • Temporal: 4.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The resource has correctly configured its protection against deletion

Resources:
LoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Name: "test-Application-Load-Balancer"
IpAddressType: String
LoadBalancerAttributes:
- Key: "deletion_protection.enabled"
Value: true
- Key: "access_logs.s3.bucket"
Value: "bk"

Non compliant code

The resource does not have any protection against deletion

Resources:
LoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Name: "test-Application-Load-Balancer"
IpAddressType: String
LoadBalancerAttributes:
- Key: "deletion_protection.enabled"
Value: false
- Key: "access_logs.s3.bucket"
Value: "bk"

Using the AWS CLI, verify that ELB has protection against deletion using the following command

$ aws elbv2 describe-load-balancer-attributes
--region us-east-1
--load-balancer-arn {elb_arn_id}
--query 'Attributes[?(Key == `deletion_protection.enabled`)].Value | []'

If the command output returns false, deletion protection is not enabled for the selected instance

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.