RDS instance has no deletion protection and no backup retention

Severity: Medium
Service: RDS
Check ID: RDS_NO_DELETION_WINDOW

What this check finds

This RDS instance has both deletion protection disabled and backup retention set to 0. If deleted, all data is permanently lost with no automated snapshot to restore from.

Passing looks like: RDS has deletion protection or backup retention.

How to fix it

Enable deletion protection and set a backup retention period of at least 7 days.

AWS CLI

aws rds modify-db-instance --db-instance-identifier DB_ID --deletion-protection --backup-retention-period 7 --apply-immediately

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to RDS instance has no deletion protection and no backup retention
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	CP-9 System Backup SI-12 Information Management and Retention
NIST Cybersecurity Framework 2.0	PR.DS-11 Backups of data are created and protected
ISO/IEC 27001:2022 Annex A	A.5.30 ICT readiness for business continuity A.8.10 Information deletion A.8.13 Information backup

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More RDS checks

All RDS checks