Skip to main content

πŸ›‘οΈ AWS RDS Instance automated backups are not enabled🟒

  • Contextual name: πŸ›‘οΈ Instance automated backups are not enabled🟒
  • ID: /ce/ca/aws/rds/instance-automated-backups
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

Ensure that Amazon Relational Database Service (RDS) instances have automated backups enabled.

Automated backups allow you to recover your database to any point in time within your specified retention period (up to 35 days). When automated backups are enabled, RDS automatically performs a full daily snapshot of your data (during your preferred backup window) and captures transaction logs (as updates to your DB instance are made).

Rationale​

Disabling automated backups eliminates the ability to perform point-in-time recovery. In the event of data corruption, accidental deletion, or hardware failure, you may lose critical data if recent backups are not available.

Audit​

This policy flags an AWS RDS Instance as INCOMPLIANT if the Backup Retention Period is set to 0.

Remediation​

Open File

Remediation​

Enable Automated Backups​

From Command Line​

To enable automated backups for an RDS instance, use the modify-db-instance command. Specify the desired retention period in days (up to 35) and apply the change immediately if appropriate:

aws rds modify-db-instance \
    --db-instance-identifier {{db-instance}} \
    --backup-retention-period 3 \
    --apply-immediately

For Multi-AZ DB clusters, use the modify-db-cluster command instead:

aws rds modify-db-cluster \
    --db-cluster-identifier {{db-cluster}} \
    --backup-retention-period 3 \
    --apply-immediately

You can include either the --apply-immediately flag to apply changes right away, or --no-apply-immediately to defer the update until the next maintenance window.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [RDS.11] RDS instances should have automatic backups enabled1no data
πŸ’Ό AWS Well-Architected β†’ πŸ’Ό REL09-BP01 Identify and back up all data that needs to be backed up, or reproduce the data from sources2no data
πŸ’Ό AWS Well-Architected β†’ πŸ’Ό REL09-BP03 Perform data backup automatically3no data
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Data Protection and Recovery18no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CP-6 Alternate Storage Site (M)(H)312no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CP-6(1) Separation from Primary Site (M)(H)3no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CP-6(2) Recovery Time and Recovery Point Objectives (H)12no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CP-9 System Backup (L)(M)(H)5410no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CP-10 System Recovery and Reconstitution (L)(M)(H)212no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό SI-12 Information Management and Retention (L)(M)(H)5no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CP-9 System Backup (L)(M)(H)9no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CP-10 System Recovery and Reconstitution (L)(M)(H)12no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό SI-12 Information Management and Retention (L)(M)(H)5no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CP-6 Alternate Storage Site (M)(H)23no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CP-6(1) Separation from Primary Site (M)(H)3no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CP-9 System Backup (L)(M)(H)210no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CP-10 System Recovery and Reconstitution (L)(M)(H)112no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό SI-12 Information Management and Retention (L)(M)(H)5no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained5no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles25no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected148no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected142no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-11: Backups of data are created, protected, maintained, and tested12no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.IR-04: Adequate resource capacity to ensure availability is maintained3no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process12no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed12no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration6no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed12no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CP-6 Alternate Storage Site312no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CP-6(1) Alternate Storage Site _ Separation from Primary Site3no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives12no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CP-9 System Backup87no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CP-10 System Recovery and Reconstitution612no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy11no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-12 Information Management and Retention35no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-13(5) Predictable Failure Prevention _ Failover Capability11no data