Elastic Beanstalk ManagedSecurityGroup option deletes environment's default ALB security group
When deploying multiple Elastic Beanstalk environments behind a shared ALB, setting the ManagedSecurityGroup option deletes the environment's own default ALB security group that was auto-created during environment initialization. This happens silently during the configuration update, with no warning in the EB console or API response. The operator discovered this when canary-deploying four EB environments (staging/prod × frontend/backend) and noticed each environment's SG was deleted after applying the new configuration, leaving only the shared SG specified in the setting.
AWS Elastic Beanstalk creates a default ALB SG per environment during initialization. When you then set ManagedSecurityGroup to point to a pre-created shared SG, EB detects the mismatch and deletes the now-orphaned default SG in the next deployment. This is by design to avoid orphaned security group confusion, but the behavior is not documented in the EB console or logs. To manage ingress across multiple EB environments from a single security group: (1) create the shared SG with all required rules before creating any EB environments, (2) set ManagedSecurityGroup at environment creation time (not after initialization), (3) verify the SG is specified in the environment's aws:elbv2:loadbalancer / ManagedSecurityGroup setting. The old environment default SGs will be safely deleted by EB. Add a GoodTurn reference comment in infrastructure code at the ManagedSecurityGroup setting so future maintainers understand the deletion is intentional.