Backtrack Feature Should Be Enabled

More Info:

Backtrack feature should be enabled for your Amazon Aurora with MySQL compatibility database clusters in order to backtrack your clusters to a specific time, without using backups

Risk Level

Low

Addresses

Reliability,Security

Compliance Standards

CBP

Remediation

Using Console

To remediate the misconfiguration of enabling the Backtrack feature for an AWS RDS instance using the AWS Management Console, follow these steps:

Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
Navigate to the RDS Console: Click on the “Services” dropdown menu at the top of the page, select “RDS” under the Database category.
Select the RDS Instance: From the list of RDS instances, click on the instance for which you want to enable the Backtrack feature.
Enable Backtrack Feature:
- In the navigation pane on the left, click on “Modify”.
- Scroll down to the “Backup” section.
- Find the “Enable Backtrack” option and check the box to enable it.
Apply Changes: Scroll to the bottom of the page and click on the “Continue” button.
Review and Apply Changes: Review the changes you are about to make and click on the “Modify DB Instance” button to apply the changes.
Monitor the Status: Once the modification is complete, monitor the RDS instance status to ensure that the Backtrack feature has been successfully enabled.

By following these steps, you should be able to remediate the misconfiguration of enabling the Backtrack feature for an AWS RDS instance using the AWS Management Console.

Using CLI

To remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance using AWS CLI, follow these steps:

Check the current Backtrack status: Run the following AWS CLI command to check if the Backtrack feature is currently enabled for your RDS instance:

aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --query 'DBInstances[0].[DBInstanceIdentifier,BacktrackWindow]'

Enable Backtrack feature: If the Backtrack feature is not enabled, you can enable it by modifying the RDS instance with the following AWS CLI command:
aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --enable-backtrack

Verify Backtrack feature: Run the describe-db-instances command again to verify that the Backtrack feature is now enabled for your RDS instance:

aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --query 'DBInstances[0].[DBInstanceIdentifier,BacktrackWindow]'

Note:
- Replace YOUR_DB_INSTANCE_IDENTIFIER with the actual identifier of your RDS instance.
- The Backtrack feature allows you to rewind your RDS instance to a specific point in time within the backtrack window. Note that enabling Backtrack may incur additional costs.

By following these steps, you can remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance using AWS CLI.

Using Python

To remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance using Python, you can follow these steps:

Install the AWS SDK for Python (Boto3) if you haven’t already. You can install it using pip:
pip install boto3
Use the following Python script to enable the Backtrack feature for the AWS RDS instance:

import boto3

# Define the AWS region and RDS instance identifier
region = 'your_aws_region'
instance_identifier = 'your_rds_instance_identifier'

# Create an RDS client
rds_client = boto3.client('rds', region_name=region)

# Enable the Backtrack feature for the RDS instance
try:
    response = rds_client.modify_db_instance(
        DBInstanceIdentifier=instance_identifier,
        EnableBacktrack=True
    )
    print("Backtrack feature enabled successfully for RDS instance: {}".format(instance_identifier))
except Exception as e:
    print("Error enabling Backtrack feature: {}".format(str(e)))

Replace 'your_aws_region' and 'your_rds_instance_identifier' with the actual AWS region and RDS instance identifier where the Backtrack feature needs to be enabled.
Run the Python script, and it will enable the Backtrack feature for the specified RDS instance in the specified AWS region.

By following these steps and running the Python script, you can successfully remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance.

Additional Reading

[https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html]

Triage and Remediation

Remediation

Remediation

Using Console

For AWS RDS, the Backtrack feature applies only to Amazon Aurora MySQL-Compatible Edition. It must be configured at cluster creation (or when restoring from snapshot); you cannot just “turn it on” for an existing cluster.Below are the step‑by‑step options using the AWS Management Console.

1. When creating a new Aurora MySQL cluster (preferred if you can recreate)

Sign in to the AWS Management Console and open RDS:
- Services → RDS
In the left navigation pane, choose Databases.
Choose Create database.
Under Engine options:
- Engine type: Amazon Aurora
- Edition: Amazon Aurora MySQL-Compatible Edition
Scroll down to Settings and DB cluster identifier, fill as required.
In the Additional configuration (or Backup / Additional settings, UI wording can vary):
- Find the Backtrack section.
- Check/enable Backtrack.
- Set Backtrack window (in hours or seconds depending on UI; e.g., 24 hours).
Configure the rest of the options as desired (instance class, VPC, security groups, etc.).
At the bottom, choose Create database.

Your new Aurora MySQL cluster will now have Backtrack enabled.

2. Enabling Backtrack for an existing cluster (requires creating a new one)

If you already have an Aurora MySQL cluster without Backtrack, you must create a new cluster from a snapshot with Backtrack enabled.

2.1 Take a snapshot (if you don’t already have one)

In the RDS console, go to Databases.
Select your Aurora MySQL DB cluster.
Choose Actions → Take snapshot.
Provide a Snapshot name and choose Take snapshot.
Wait for the snapshot status to become Available.

2.2 Restore from snapshot with Backtrack enabled

In the RDS console, go to Snapshots (left navigation).
Select the snapshot you want to use (DB cluster snapshot for Aurora).
Choose Actions → Restore snapshot (or Restore DB cluster).
In the restore wizard:
- Engine should show Amazon Aurora MySQL-Compatible Edition.
- Provide a new DB cluster identifier.
Under Additional configuration / Backup / Backtrack:
- Enable Backtrack.
- Set the Backtrack window (e.g., 24 hours).
Configure networking, security groups, parameter groups, and instance sizes as you need.
Choose Restore DB cluster (or Create database).
Wait for the new cluster and its instances to become Available.
Update your applications to point to the new cluster endpoint ( writer endpoint and any reader endpoints if used).
After you confirm everything works and traffic is fully cut over, you can:
- Optionally delete the old cluster to avoid extra cost.

3. Verify Backtrack is enabled

In RDS → Databases, select your Aurora MySQL cluster.
On the Configuration tab:
- Check for Backtrack settings (enabled and window value).

You’ve now remediated the “Backtrack Feature Should Be Enabled” requirement for the Aurora MySQL cluster via the AWS console.

Using CLI

Below are the concrete AWS CLI steps to enable the Backtrack feature on an Amazon Aurora MySQL DB cluster (the only engine that supports it).

Prerequisites

DB engine must be Aurora MySQL (not Aurora PostgreSQL or standard RDS engines).

Engine version must support Backtrack (Aurora MySQL 1.x/2.x+ for MySQL 5.6/5.7 compatible).

The cluster must use aurora or aurora-mysql engine type.

1. Identify the DB cluster and verify engine

aws rds describe-db-clusters \
  --db-cluster-identifier <your-cluster-id> \
  --query "DBClusters[0].[DBClusterIdentifier,Engine,EngineVersion,BacktrackWindow]" \
  --output table

Confirm:

Engine is aurora-mysql (or a compatible Aurora MySQL engine string).
BacktrackWindow is 0 or unset (meaning not enabled).

2. Choose a Backtrack window

Decide how far back you want to be able to backtrack, in seconds.
Example: 24 hours:

BACKTRACK_WINDOW=$((24*60*60))  # 86400 seconds

3. Enable Backtrack on the cluster

Run modify-db-cluster with --backtrack-window set to your chosen value:

aws rds modify-db-cluster \
  --db-cluster-identifier <your-cluster-id> \
  --backtrack-window 86400 \
  --apply-immediately

Notes:

--apply-immediately applies the change right away.
To defer to next maintenance window, omit --apply-immediately.

4. Confirm that Backtrack is enabled

aws rds describe-db-clusters \
  --db-cluster-identifier <your-cluster-id> \
  --query "DBClusters[0].[DBClusterIdentifier,BacktrackWindow,EarliestBacktrackTime,LatestRestorableTime]" \
  --output table

BacktrackWindow should now show your value (e.g., 86400).
EarliestBacktrackTime appears after some transaction history accumulates.

5. (Optional) Create a new cluster with Backtrack enabled from the start

If you’re creating a new Aurora MySQL cluster and want Backtrack on from the beginning:

aws rds create-db-cluster \
  --db-cluster-identifier <your-cluster-id> \
  --engine aurora-mysql \
  --master-username <user> \
  --master-user-password <password> \
  --backtrack-window 86400 \
  --engine-version <supported-aurora-mysql-version> \
  --vpc-security-group-ids <sg-ids> \
  --db-subnet-group-name <subnet-group-name>

If your cluster is not Aurora MySQL or the version doesn’t support Backtrack, there is no CLI remediation for “Backtrack feature should be enabled” other than migrating to a supported Aurora MySQL engine/version.

Using Python

For AWS RDS, Backtrack is only supported on Amazon Aurora MySQL-compatible DB clusters, not on standard RDS engines. You enable it by setting BacktrackWindow on the DB cluster, not the instance.Below are the steps and sample Python (boto3) code.

1. Prerequisites & checks

Install boto3 (if not already):
pip install boto3
Ensure:
- The DB is Aurora MySQL (e.g., aurora-mysql).
- Engine version supports backtrack (e.g., Aurora MySQL 1.11 or later, or 2.04 or later; check AWS docs for current versions).
- You have IAM permissions:
  - rds:DescribeDBClusters
  - rds:ModifyDBCluster
Identify the DB cluster identifier (not DB instance identifier).
You can find this in the console (RDS → Databases → your Aurora cluster → “DB cluster identifier”).

2. Python example – enable backtrack on a cluster

This script:

Verifies the cluster exists
Confirms it’s Aurora MySQL
Enables backtrack with a specific window (e.g., 8 hours)

import boto3
from botocore.exceptions import ClientError

REGION = "us-east-1"        # change as needed
DB_CLUSTER_ID = "my-aurora-cluster"  # your Aurora DB cluster identifier
BACKTRACK_HOURS = 8         # how many hours back you want
BACKTRACK_WINDOW = BACKTRACK_HOURS * 60 * 60  # seconds

rds = boto3.client("rds", region_name=REGION)

def get_cluster(cluster_id):
    try:
        resp = rds.describe_db_clusters(DBClusterIdentifier=cluster_id)
        return resp["DBClusters"][0]
    except ClientError as e:
        print(f"Error describing cluster: {e}")
        return None

def enable_backtrack(cluster_id, backtrack_window_seconds):
    try:
        resp = rds.modify_db_cluster(
            DBClusterIdentifier=cluster_id,
            BacktrackWindow=backtrack_window_seconds,
            ApplyImmediately=True
        )
        print("Backtrack enabled/updated on cluster:")
        print(f"  Cluster ID: {resp['DBCluster']['DBClusterIdentifier']}")
        print(f"  BacktrackWindow: {resp['DBCluster']['BacktrackWindow']} seconds")
    except ClientError as e:
        print(f"Error enabling backtrack: {e}")

def main():
    cluster = get_cluster(DB_CLUSTER_ID)
    if not cluster:
        return

    engine = cluster.get("Engine")
    engine_version = cluster.get("EngineVersion")
    print(f"Cluster engine: {engine}, version: {engine_version}")

    if engine != "aurora-mysql":
        print("Backtrack is only supported for Aurora MySQL clusters.")
        return

    # Optional: Show current backtrack window
    current_window = cluster.get("BacktrackWindow", 0)
    print(f"Current BacktrackWindow: {current_window} seconds")

    # Enable or update backtrack window
    enable_backtrack(DB_CLUSTER_ID, BACKTRACK_WINDOW)

if __name__ == "__main__":
    main()

3. Adjusting / disabling later (if needed)

To change the window, call modify_db_cluster again with a new BacktrackWindow value.
To disable backtrack, set:
BacktrackWindow = 0

If you share your cluster identifier and region (redacted as needed), I can adapt the exact Python snippet for your setup.

Using Terraform

resource "aws_rds_cluster" "aurora_mysql_cluster" {
  cluster_identifier = "AURORA_MYSQL_CLUSTER_IDENTIFIER" # e.g. "prod-aurora-mysql-cluster"
  engine             = "aurora-mysql"
  engine_version     = "AURORA_MYSQL_ENGINE_VERSION"     # e.g. "8.0.mysql_aurora.3.04.0"

  master_username = "MASTER_USERNAME"
  master_password = "MASTER_PASSWORD"

  # Enable Backtrack (value in seconds; example is 24 hours)
  backtrack_window = 86400

  # ...other required arguments (vpc_security_group_ids, db_subnet_group_name, etc.)...
}

Substitute:

AURORA_MYSQL_CLUSTER_IDENTIFIER with your cluster identifier.
AURORA_MYSQL_ENGINE_VERSION with a Backtrack-supported Aurora MySQL engine version.
MASTER_USERNAME / MASTER_PASSWORD with your credentials or references to secrets.

This change updates the existing cluster in place (no forced replacement), though AWS may perform a brief modification operation on the cluster.For verification, terraform plan should show the existing aws_rds_cluster with:

~ backtrack_window: "0" => "86400" (or your chosen non-zero value).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Backtrack Feature Should Be Enabled

More Info:

Risk Level

Addresses

Compliance Standards

Remediation

Using Console

Using CLI

Using Python

Additional Reading

Triage and Remediation

Remediation

1. When creating a new Aurora MySQL cluster (preferred if you can recreate)

2. Enabling Backtrack for an existing cluster (requires creating a new one)

2.1 Take a snapshot (if you don’t already have one)

2.2 Restore from snapshot with Backtrack enabled

3. Verify Backtrack is enabled

1. Identify the DB cluster and verify engine

2. Choose a Backtrack window

3. Enable Backtrack on the cluster

4. Confirm that Backtrack is enabled

5. (Optional) Create a new cluster with Backtrack enabled from the start

1. Prerequisites & checks

2. Python example – enable backtrack on a cluster

3. Adjusting / disabling later (if needed)

​More Info:

​Risk Level

​Addresses

​Compliance Standards

​Remediation

​Using Console

​Using CLI

​Using Python

​Additional Reading

​Triage and Remediation

​Remediation

​1. When creating a new Aurora MySQL cluster (preferred if you can recreate)

​2. Enabling Backtrack for an existing cluster (requires creating a new one)

​2.1 Take a snapshot (if you don’t already have one)

​2.2 Restore from snapshot with Backtrack enabled

​3. Verify Backtrack is enabled

​1. Identify the DB cluster and verify engine

​2. Choose a Backtrack window

​3. Enable Backtrack on the cluster

​4. Confirm that Backtrack is enabled

​5. (Optional) Create a new cluster with Backtrack enabled from the start

​1. Prerequisites & checks

​2. Python example – enable backtrack on a cluster

​3. Adjusting / disabling later (if needed)

More Info:

Risk Level

Addresses

Compliance Standards

Remediation

Using Console

Using CLI

Using Python

Additional Reading

Triage and Remediation

Remediation

1. When creating a new Aurora MySQL cluster (preferred if you can recreate)

2. Enabling Backtrack for an existing cluster (requires creating a new one)

2.1 Take a snapshot (if you don’t already have one)

2.2 Restore from snapshot with Backtrack enabled

3. Verify Backtrack is enabled

1. Identify the DB cluster and verify engine

2. Choose a Backtrack window

3. Enable Backtrack on the cluster

4. Confirm that Backtrack is enabled

5. (Optional) Create a new cluster with Backtrack enabled from the start

1. Prerequisites & checks

2. Python example – enable backtrack on a cluster

3. Adjusting / disabling later (if needed)