rules:
- id: missing-aws-lb-deletion-protection
  patterns:
    - pattern-either:
      - pattern-inside: |
          resource "aws_alb" "..." {
          ...
          }
      - pattern-inside: |
          resource "aws_lb" "..." {
          ...
          }
    - pattern-not-inside: |
        resource $ANYLB $ANYTHING {
          ...
          enable_deletion_protection = true
          ...
        }
  message: >-
    The AWS LoadBalancer deletion protection is not enabled.
  languages: [hcl]
  severity: WARNING
  metadata:
    category: best-practice
    references:
      - https://aws.amazon.com/what-is/load-balancing/#seo-faq-pairs#benefits-lb
      - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb
    technology:
    - terraform
    - aws