RDS instance has deletion protection disabled

Severity: Medium
Service: RDS
Check ID: RDS_DELETION_PROTECTION_DISABLED

What this check finds

Without deletion protection, a production database can be accidentally deleted by any IAM principal with rds:DeleteDBInstance permission. Deletion protection is a low-cost safeguard that prevents accidental or malicious data loss.

Passing looks like: RDS deletion protection enabled.

How to fix it

Enable deletion protection on the RDS instance.

AWS CLI

aws rds modify-db-instance --db-instance-identifier INSTANCE_ID --deletion-protection --apply-immediately

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

RDS → Databases → select instance → Modify → Deletion protection → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to RDS instance has deletion protection disabled
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	CP-9 System Backup SI-12 Information Management and Retention
NIST Cybersecurity Framework 2.0	PR.DS-11 Backups of data are created and protected
ISO/IEC 27001:2022 Annex A	A.5.30 ICT readiness for business continuity A.8.10 Information deletion A.8.13 Information backup

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More RDS checks

All RDS checks