More Info:
Checks if a recovery point was created for Amazon Aurora DB clusters. The rule is NON_COMPLIANT if the Amazon Relational Database Service (Amazon RDS) DB Cluster does not have a corresponding recovery point.Risk Level
HighAddress
ConfigurationCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- Cloudanix Best Practice
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Aurora DB Clusters not having a recovery point in AWS RDS using the AWS Management Console, follow these steps:
- Login to AWS Console: Go to the AWS Management Console (https://console.aws.amazon.com/) and login using your credentials.
- Navigate to RDS Dashboard: Once logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown in the top left corner and selecting “RDS” under the Database category.
- Select Aurora DB Cluster: From the list of DB instances, select the Aurora DB cluster that you want to configure a recovery point for by clicking on its identifier.
- Enable Backtrack: In the Aurora DB cluster details page, click on the “Modify” button in the top right corner.
- Configure Backtrack: Scroll down to the “Backup” section of the Modify DB Cluster page. Look for the “Backtrack” option and check the box to enable it.
- Set Backtrack Window: Set the backtrack window to the desired number of seconds or minutes. This will determine how far back in time you can backtrack the cluster.
- Review and Apply Changes: Review the other configuration settings to ensure they are correct. Once you have configured the backtrack settings, click on the “Continue” button.
- Apply Changes: On the next page, review the summary of changes and click on the “Modify DB Cluster” button to apply the changes.
- Monitor Progress: The modification process will start, and you can monitor the progress on the RDS dashboard. Once the modification is complete, the Aurora DB cluster will have a recovery point enabled.
Using CLI
Using CLI
To remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS using AWS CLI, you can follow these steps:
-
Create a DB Cluster Snapshot:
- Use the following AWS CLI command to create a manual snapshot of your Aurora DB cluster:
- Replace
<your-db-cluster-identifier>with the identifier of your Aurora DB cluster and<your-snapshot-name>with the name you want to give to the snapshot.
- Use the following AWS CLI command to create a manual snapshot of your Aurora DB cluster:
-
Enable Automated Backups:
- To ensure that automated backups are enabled for your Aurora DB cluster, use the following AWS CLI command:
- Replace
<your-db-cluster-identifier>with the identifier of your Aurora DB cluster and<retention-period-in-days>with the number of days you want to retain automated backups.
- To ensure that automated backups are enabled for your Aurora DB cluster, use the following AWS CLI command:
-
Verify Backup Configuration:
- Confirm that automated backups are enabled and the backup retention period is set correctly by running the following AWS CLI command:
- This command will display the backup configuration details of your Aurora DB cluster.
- Confirm that automated backups are enabled and the backup retention period is set correctly by running the following AWS CLI command:
Using Python
Using Python
To remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS using Python, you can follow these steps:
- Install Boto3: Ensure that you have the Boto3 library installed in your Python environment. Boto3 is the AWS SDK for Python, which allows you to interact with AWS services.
- Create a Python script: Create a Python script with the following code to enable point-in-time recovery for your Aurora DB clusters.
-
Replace placeholders: Replace
your_aws_regionwith the AWS region where your Aurora DB cluster is located andyour_db_cluster_identifierwith the name of your Aurora DB cluster. - Run the script: Execute the Python script in your environment. This will enable point-in-time recovery for your Aurora DB cluster, ensuring that recovery points are available for data restoration.
Using Terraform
Using Terraform
backup_retention_period on aws_rds_cluster is an in-place modification and does not force replacement of the cluster; adding aws_db_cluster_snapshot does not replace the cluster, it only creates and manages the snapshot (which will persist and incur storage costs until you remove the resource or set lifecycle { prevent_destroy = false } and destroy it).To verify, terraform plan should show:- An in-place update to
aws_rds_cluster.aurora_clusterchangingbackup_retention_periodto7(if it was different before). - A new
aws_db_cluster_snapshot.aurora_manual_snapshotresource to be created.

