Amazon Backup Should Be Integrated with Amazon RDS

Using Console

Below are the exact AWS Console steps to integrate AWS Backup with Amazon RDS and remediate the finding “Amazon Backup Should Be Integrated with Amazon RDS”.

1. Turn on AWS Backup for Amazon RDS (Service opt-in)

Sign in to the AWS Management Console.
Go to AWS Backup:
Services → search for “Backup” → open AWS Backup.
In the left menu, select Settings.
Under Service opt-in, find Amazon RDS.
For the Region where your RDS runs, set Amazon RDS to Enabled.
Click Confirm or Save if prompted.

2. Create (or choose) a Backup Vault

In AWS Backup, in the left menu click Backup vaults.
Click Create backup vault (skip if you already have one to use).
Enter:
- Backup vault name (e.g., rds-backup-vault).
- Optionally choose a KMS key for encryption.
Click Create backup vault.

3. Create a Backup Plan That Includes RDS

In AWS Backup, click Backup plans in the left menu.
Click Create backup plan.
Choose Build a new plan.
Fill in:
- Backup plan name (e.g., rds-daily-backup-plan).
Under Backup rule configuration:
- Rule name: e.g., rds-daily-backup.
- Backup vault: select the vault you created (e.g., rds-backup-vault).
- Backup frequency: e.g., Daily.
- Backup window: leave default or customize.
- Lifecycle: set Transition to cold storage and Expire as per your policy.
Click Create plan.

4. Assign RDS Resources to the Backup Plan

After the plan is created, open it from Backup plans.
Click Assign resources.
Configure:
- Resource assignment name: e.g., rds-production-assignment.
- IAM role:
  - Use Default role (AWSBackupDefaultServiceRole) if it exists, or
  - Let AWS Backup create a new role when prompted.
Under Assign resources:
- Resource type: choose Amazon RDS (or leave as Include all resource types and filter by tag).
- Choose one of:
  - Include specific resources → select your RDS DB instances or clusters from the list
    OR
  - Assign by tag → specify tag key/value used on your RDS instances (e.g., Backup = True).
Click Assign resources.

5. Verify Backups Are Working

Wait until the first scheduled backup window passes (or trigger an on‑demand backup).
To test on-demand:
- Go to Protected resources in AWS Backup.
- Select your RDS resource (if visible), or:
  - Go to Backup jobs → Create on‑demand backup.
  - Choose Resource type: Amazon RDS, then pick the specific RDS instance or cluster.
  - Choose the Backup vault and click Create on‑demand backup.
Confirm a job appears under Backup jobs and completes with Status: Completed.
Go to Protected resources and confirm your RDS instance shows recovery points.

Once RDS is opted in to AWS Backup and your RDS instances are assigned to a backup plan with successful recovery points, the “Amazon Backup Should Be Integrated with Amazon RDS” finding will be remediated.

Using CLI

Below are the core steps and CLI commands to integrate Amazon RDS with AWS Backup.Assumptions:

You have aws CLI configured with permissions for AWS Backup and RDS.
Replace placeholders like <REGION>, <ACCOUNT_ID>, <VAULT_NAME>, etc.

1. Opt in RDS as a protected resource in AWS Backup

aws backup update-region-settings \
  --region <REGION> \
  --resource-type-opt-in-preference '{"RDS": true}'

Verify:

aws backup get-region-settings --region <REGION>

Check that "RDS": true under ResourceTypeOptInPreference.

2. Create a Backup Vault (if you don’t already have one)

aws backup create-backup-vault \
  --region <REGION> \
  --backup-vault-name <VAULT_NAME> \
  --encryption-key-arn arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KMS_KEY_ID>

If you want the default AWS Backup KMS key, you can omit --encryption-key-arn.

3. Create a Backup Plan

Example: daily backups retained for 35 days.

aws backup create-backup-plan \
  --region <REGION> \
  --backup-plan '{
    "BackupPlanName": "rds-daily-backup-plan",
    "Rules": [
      {
        "RuleName": "DailyRDSBackups",
        "TargetBackupVaultName": "<VAULT_NAME>",
        "ScheduleExpression": "cron(0 5 * * ? *)",
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 180,
        "Lifecycle": {
          "DeleteAfterDays": 35
        }
      }
    ]
  }'

Note the BackupPlanId from the response.

4. Create/Use an IAM Role for AWS Backup

If you don’t already have the required role, create one with the AWS managed policy AWSBackupServiceRolePolicyForBackup.Trust policy (example file trust-policy.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "backup.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create the role:

aws iam create-role \
  --role-name AWSBackupDefaultServiceRole \
  --assume-role-policy-document file://trust-policy.json

Attach the managed policy:

aws iam attach-role-policy \
  --role-name AWSBackupDefaultServiceRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup

Use the role ARN in the next step: arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole

5. Assign RDS Databases to the Backup Plan

You can target RDS instances by ARN or by tag.

Option A – Select specific RDS instances by ARN

Get your RDS instance ARN(s):

aws rds describe-db-instances \
  --region <REGION> \
  --query 'DBInstances[*].DBInstanceArn' \
  --output text

Create a backup selection:

aws backup create-backup-selection \
  --region <REGION> \
  --backup-plan-id <BACKUP_PLAN_ID> \
  --backup-selection '{
    "SelectionName": "rds-instance-selection",
    "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
    "Resources": [
      "arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME>"
    ]
  }'

Option B – Use tags to select RDS instances

Tag your RDS instances:

aws rds add-tags-to-resource \
  --region <REGION> \
  --resource-name arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME> \
  --tags Key=Backup,Value=Daily

Create tag-based selection:

aws backup create-backup-selection \
  --region <REGION> \
  --backup-plan-id <BACKUP_PLAN_ID> \
  --backup-selection '{
    "SelectionName": "tagged-rds-selection",
    "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
    "ListOfTags": [
      {
        "ConditionType": "STRINGEQUALS",
        "ConditionKey": "Backup",
        "ConditionValue": "Daily"
      }
    ]
  }'

6. Verify Backups

List backup jobs:

aws backup list-backup-jobs --region <REGION>

Filter for ResourceType = RDS and confirm jobs complete successfully.This completes integrating Amazon RDS with AWS Backup using the CLI.

Using Python

Below is a concise, step‑by‑step way (with Python/boto3 code) to integrate Amazon RDS with AWS Backup. The focus is: create a backup plan, ensure required IAM role, and assign RDS resources to that plan.

1. Prerequisites

An RDS instance exists.
You have:
- boto3 installed
- AWS credentials configured with permissions for:
  - backup:*
  - rds:DescribeDBInstances
  - iam:CreateRole, iam:AttachRolePolicy (or an existing service role for AWS Backup)

pip install boto3

2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

AWS Backup usually uses AWSBackupDefaultServiceRole. If it doesn’t exist, create it.

import json
import boto3
from botocore.exceptions import ClientError

iam = boto3.client("iam")

role_name = "AWSBackupDefaultServiceRole"
assume_role_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"Service": "backup.amazonaws.com"},
            "Action": "sts:AssumeRole"
        }
    ]
}

def ensure_backup_role():
    try:
        iam.get_role(RoleName=role_name)
        print(f"Role {role_name} already exists")
    except ClientError as e:
        if e.response["Error"]["Code"] == "NoSuchEntity":
            print(f"Creating role {role_name}")
            iam.create_role(
                RoleName=role_name,
                AssumeRolePolicyDocument=json.dumps(assume_role_policy),
                Description="Service role for AWS Backup"
            )
        else:
            raise

    # Attach AWS managed policy for Backup
    iam.attach_role_policy(
        RoleName=role_name,
        PolicyArn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
    )

ensure_backup_role()

3. Identify Your RDS Instance

You need the DB instance ARN.

import boto3

rds = boto3.client("rds")

db_instance_id = "my-db-instance-id"   # change to your DB instance ID

response = rds.describe_db_instances(DBInstanceIdentifier=db_instance_id)
db_arn = response["DBInstances"][0]["DBInstanceArn"]
print("RDS ARN:", db_arn)

4. Create an AWS Backup Plan (if you don’t already have one)

Example: daily backup, 35‑day retention.

import boto3
from datetime import datetime, timezone, timedelta

backup = boto3.client("backup")

backup_plan_name = "rds-daily-backup-plan"
rule_name = "daily-rds-backup"

# Example: run daily at 05:00 UTC
schedule_cron = "cron(0 5 * * ? *)"

backup_plan = {
    "BackupPlanName": backup_plan_name,
    "Rules": [
        {
            "RuleName": rule_name,
            "TargetBackupVaultName": "Default",
            "ScheduleExpression": schedule_cron,
            "StartWindowMinutes": 60,    # optional
            "CompletionWindowMinutes": 180,  # optional
            "Lifecycle": {
                "DeleteAfterDays": 35
            }
        }
    ]
}

create_resp = backup.create_backup_plan(BackupPlan=backup_plan)
backup_plan_id = create_resp["BackupPlanId"]
print("Backup Plan ID:", backup_plan_id)

If you already have a plan, you can just capture its BackupPlanId instead of creating a new one.

5. Assign the RDS Instance to the Backup Plan

You can assign by:

Direct ARN, or
Tags

Here we assign by resource ARN.

from uuid import uuid4

backup = boto3.client("backup")

selection_name = f"rds-selection-{uuid4()}"

selection = {
    "SelectionName": selection_name,
    "IamRoleArn": f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",  # replace
    "Resources": [db_arn],
    # or use "ListOfTags" instead of "Resources" if you prefer tag-based assignments
}

selection_resp = backup.create_backup_selection(
    BackupPlanId=backup_plan_id,
    BackupSelection=selection
)

print("Backup Selection ID:", selection_resp["SelectionId"])

6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

To verify integration, you can run an on‑demand backup:

job_resp = backup.start_backup_job(
    BackupVaultName="Default",
    ResourceArn=db_arn,
    IamRoleArn=f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole"
)

print("Backup Job ID:", job_resp["BackupJobId"])

Summary

To remediate “Amazon Backup Should Be Integrated with Amazon RDS” via Python:

Ensure AWSBackupDefaultServiceRole exists and has the right policy.
Get your RDS instance ARN.
Create (or choose) an AWS Backup plan with schedule/retention.
Create a backup selection that includes the RDS ARN and uses the backup role.
Optionally run an on‑demand backup to confirm.

You can bundle these snippets into a single script and parameterize RDS instance ID, account ID, schedule, and retention as needed.

Using Terraform

resource "aws_backup_vault" "rds_vault" {
  name        = "rds-backup-vault"
  kms_key_arn = "KMS_KEY_ARN_FOR_BACKUP_VAULT" # replace with your KMS key ARN or remove if using default
}

resource "aws_backup_plan" "rds_plan" {
  name = "rds-backup-plan"

  rule {
    rule_name         = "rds-daily-backup"
    target_vault_name = aws_backup_vault.rds_vault.name

    schedule = "cron(0 5 * * ? *)" # daily at 05:00 UTC

    lifecycle {
      delete_after = 30 # keep backups for 30 days
    }
  }
}

# Example RDS instance that will be protected by AWS Backup
resource "aws_db_instance" "rds" {
  identifier        = "RDS_INSTANCE_IDENTIFIER" # replace
  engine            = "mysql"
  instance_class    = "db.t3.micro"
  allocated_storage = 20

  username = "DB_MASTER_USERNAME" # replace
  password = "DB_MASTER_PASSWORD" # replace

  # other required arguments...
}

# Attach the RDS instance to the AWS Backup plan
resource "aws_backup_selection" "rds_selection" {
  name         = "rds-selection"
  iam_role_arn = "AWS_BACKUP_ROLE_ARN" # replace with IAM role ARN that AWS Backup uses
  plan_id      = aws_backup_plan.rds_plan.id

  resources = [
    aws_db_instance.rds.arn,
  ]
}

This configuration creates an AWS Backup vault and plan, then integrates the RDS instance with that plan via aws_backup_selection (no resource replacement of the RDS instance is required).On terraform plan you should see creation of aws_backup_vault.rds_vault, aws_backup_plan.rds_plan, and aws_backup_selection.rds_selection, with no destructive changes to existing RDS resources.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Amazon Backup Should Be Integrated with Amazon RDS

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

1. Turn on AWS Backup for Amazon RDS (Service opt-in)

2. Create (or choose) a Backup Vault

3. Create a Backup Plan That Includes RDS

4. Assign RDS Resources to the Backup Plan

5. Verify Backups Are Working

1. Opt in RDS as a protected resource in AWS Backup

2. Create a Backup Vault (if you don’t already have one)

3. Create a Backup Plan

4. Create/Use an IAM Role for AWS Backup

5. Assign RDS Databases to the Backup Plan

Option A – Select specific RDS instances by ARN

Option B – Use tags to select RDS instances

6. Verify Backups

1. Prerequisites

2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

3. Identify Your RDS Instance

4. Create an AWS Backup Plan (if you don’t already have one)

5. Assign the RDS Instance to the Backup Plan

6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

Summary

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using AWS Console

​Triage and Remediation

​Remediation

​1. Turn on AWS Backup for Amazon RDS (Service opt-in)

​2. Create (or choose) a Backup Vault

​3. Create a Backup Plan That Includes RDS

​4. Assign RDS Resources to the Backup Plan

​5. Verify Backups Are Working

​1. Opt in RDS as a protected resource in AWS Backup

​2. Create a Backup Vault (if you don’t already have one)

​3. Create a Backup Plan

​4. Create/Use an IAM Role for AWS Backup

​5. Assign RDS Databases to the Backup Plan

​Option A – Select specific RDS instances by ARN

​Option B – Use tags to select RDS instances

​6. Verify Backups

​1. Prerequisites

​2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

​3. Identify Your RDS Instance

​4. Create an AWS Backup Plan (if you don’t already have one)

​5. Assign the RDS Instance to the Backup Plan

​6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

​Summary

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

1. Turn on AWS Backup for Amazon RDS (Service opt-in)

2. Create (or choose) a Backup Vault

3. Create a Backup Plan That Includes RDS

4. Assign RDS Resources to the Backup Plan

5. Verify Backups Are Working

1. Opt in RDS as a protected resource in AWS Backup

2. Create a Backup Vault (if you don’t already have one)

3. Create a Backup Plan

4. Create/Use an IAM Role for AWS Backup

5. Assign RDS Databases to the Backup Plan

Option A – Select specific RDS instances by ARN

Option B – Use tags to select RDS instances

6. Verify Backups

1. Prerequisites

2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

3. Identify Your RDS Instance

4. Create an AWS Backup Plan (if you don’t already have one)

5. Assign the RDS Instance to the Backup Plan

6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

Summary

Additional Reading: