Skip to main content

More Info:

Checks if an Amazon Neptune DB cluster has deletion protection enabled. The rule is NON_COMPLIANT if an Amazon Neptune cluster has the deletionProtection field set to false.

Risk Level

High

Address

Configuration

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of Neptune DB Cluster not having deletion protection enabled in AWS RDS, you can follow these step-by-step instructions using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login with your credentials.
  2. Navigate to Amazon Neptune Service: Click on the “Services” dropdown in the top-left corner of the console, then select “Neptune” under the Database category.
  3. Select the DB Cluster: From the list of Neptune DB Clusters, select the DB Cluster for which you want to enable deletion protection.
  4. Modify DB Cluster: In the DB Cluster details page, click on the “Actions” dropdown button and select “Modify”.
  5. Enable Deletion Protection: Scroll down to the “Additional configuration” section in the Modify DB Cluster page. Locate the “Deletion protection” option and check the box to enable deletion protection for the DB Cluster.
  6. Review and Apply Changes: Review the other configuration settings to ensure they are correct. Once you have verified the changes, click on the “Modify cluster” button to apply the changes.
  7. Monitor the Modification: The modification process may take a few minutes to complete. You can monitor the progress on the DB Cluster details page.
By following these steps, you have successfully enabled deletion protection for the Neptune DB Cluster in AWS RDS, ensuring that accidental deletion of the DB Cluster is prevented.

To remediate the misconfiguration of Neptune DB Cluster not having deletion protection enabled in AWS RDS using AWS CLI, follow these steps:
  1. Install and Configure AWS CLI:
  2. Enable Deletion Protection for Neptune DB Cluster:
    • Run the following AWS CLI command to enable deletion protection for your Neptune DB Cluster:
      Replace <your-db-cluster-identifier> with the actual identifier of your Neptune DB Cluster.
  3. Verify Deletion Protection Status:
    • To verify that deletion protection has been successfully enabled for your Neptune DB Cluster, you can describe the cluster using the following command:
      This command will return the identifier of the DB Cluster and its deletion protection status.
  4. Ensure Deletion Protection Persists:
    • It is recommended to periodically check the deletion protection status of your Neptune DB Cluster to ensure that it persists over time. You can use the same describe command mentioned in step 3 for this purpose.
By following these steps, you can successfully remediate the misconfiguration of Neptune DB Cluster not having deletion protection enabled in AWS RDS using AWS CLI.
To remediate the misconfiguration of Neptune DB Cluster not having deletion protection enabled in AWS RDS using Python, you can follow these steps:
  1. Import the necessary libraries:
  1. Initialize the AWS RDS client:
  1. Get a list of all Neptune DB Clusters:
  1. Iterate through each DB Cluster and enable deletion protection if it is not already enabled:
  1. Run the Python script to enable deletion protection for all Neptune DB Clusters in your AWS RDS.
Please ensure that you have the necessary IAM permissions to modify RDS DB Clusters and that your AWS credentials are properly configured for the boto3 library to work.
If this cluster already exists, changing deletion_protection from false to true is an in‑place modification and does not force resource replacement.Verification: terraform plan should show an in-place update on aws_neptune_cluster.THIS_CLUSTER with deletion_protection changing from false (or 0) to true (or 1).

Additional Reading: