RDS automated backups are disabled

Severity: High
Service: RDS
Check ID: RDS_BACKUP_DISABLED

What this check finds

With a backup retention period of 0, RDS automated backups are disabled. This means there is no point-in-time recovery for the database. Data loss from accidental deletion, corruption, or ransomware cannot be recovered.

Passing looks like: RDS automated backups enabled.

How to fix it

Set a non-zero backup retention period (minimum 7 days recommended).

AWS CLI

aws rds modify-db-instance --db-instance-identifier INSTANCE_ID --backup-retention-period 7 --apply-immediately

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

RDS → Databases → select instance → Modify → Backup → Backup retention period.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to RDS automated backups are disabled
Framework	Controls
HIPAA Security Rule	164.308(a)(7) Contingency Plan — Data Backup, Disaster Recovery, Emergency Mode 164.312(c)(1) Implement policies to protect ePHI from improper alteration or destruction
SOC 2 — Trust Services Criteria	A1.2 Environmental, regulatory, and technological changes are identified and the effects on availability are monitored
NIST SP 800-53 Rev5 (Moderate)	CP-9 System Backup
NIST Cybersecurity Framework 2.0	PR.DS-11 Backups of data are created and protected
ISO/IEC 27001:2022 Annex A	A.5.30 ICT readiness for business continuity A.8.13 Information backup

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More RDS checks

All RDS checks