Backup Retention Duration Should Be Present

Using Console

To fix “Backup Retention Duration Should Be Present” for an AWS RDS instance via the AWS Console, you need to enable/adjust Automated Backups (Backup retention period > 0).

For an existing RDS DB instance

Sign in to the AWS Management Console and go to RDS.
In the left menu, click Databases.
Select the DB instance you want to fix.
Click Modify (top right).
Scroll to the Additional configuration (or Backup) section:
- Find Backup retention period.
- Set it to a value between 1 and 35 days (e.g., 7).
- Optionally adjust Backup window if you want a specific time.
Scroll down and click Continue.
Under Scheduling of modifications, choose:
- Apply immediately (for instant change), or
- During the next maintenance window (safer for production).
Click Modify DB instance to save.

For a new RDS DB instance

In RDS Console → Databases → Create database.
Choose engine and template as usual.
In Additional configuration / Backup section:
- Set Backup retention period to ≥ 1 day.
- Configure backup window if desired.
Complete other settings and click Create database.

Once the retention period is > 0, the “Backup Retention Duration Should Be Present” finding for that RDS instance should be resolved.

Using CLI

For Amazon RDS, “Backup Retention Duration Should Be Present” means the automated backup retention period must be set to a non-zero value (for Aurora: set on the cluster; for non-Aurora: on the instance).Below are step‑by‑step AWS CLI instructions.

1. Identify RDS Instances with Backup Retention = 0

aws rds describe-db-instances \
  --query "DBInstances[?BackupRetentionPeriod==\`0\`].[DBInstanceIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

This lists RDS instances that have automated backups disabled.

2. Decide Your Desired Retention Period

Choose a value between 1 and 35 (days), according to your policy (e.g., 7 or 30 days).
In the examples below, I’ll use 7.

3. Remediate Non-Aurora RDS Instances

Replace my-db-instance-id and 7 with your values.

aws rds modify-db-instance \
  --db-instance-identifier my-db-instance-id \
  --backup-retention-period 7 \
  --apply-immediately

Key flags:

--backup-retention-period 7 → enables automated backups, keeps 7 days
--apply-immediately → apply change right away (omit if you prefer next maintenance window)

Repeat for each instance that had BackupRetentionPeriod == 0.

4. Remediate Aurora Clusters (if using Aurora)

For Aurora, retention is configured at the cluster level.

4.1. Find Aurora clusters with retention = 0

aws rds describe-db-clusters \
  --query "DBClusters[?BackupRetentionPeriod==\`0\`].[DBClusterIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

4.2. Set retention on each cluster

aws rds modify-db-cluster \
  --db-cluster-identifier my-aurora-cluster-id \
  --backup-retention-period 7 \
  --apply-immediately

5. Verify the Change

For a specific instance:

aws rds describe-db-instances \
  --db-instance-identifier my-db-instance-id \
  --query "DBInstances[0].[DBInstanceIdentifier,BackupRetentionPeriod]" \
  --output table

For a specific Aurora cluster:

aws rds describe-db-clusters \
  --db-cluster-identifier my-aurora-cluster-id \
  --query "DBClusters[0].[DBClusterIdentifier,BackupRetentionPeriod]" \
  --output table

Once BackupRetentionPeriod is greater than 0, the misconfiguration is remediated.

Using Python

For AWS RDS, “Backup Retention Duration Should Be Present” means BackupRetentionPeriod must be > 0 (automated backups enabled). Below is how to remediate it using Python (boto3).

1. Prerequisites

Install and configure AWS CLI or set env vars so boto3 has credentials:
pip install boto3 aws configure
Ensure your IAM role/user has:
- rds:DescribeDBInstances
- rds:ModifyDBInstance

2. Identify RDS instances with no backup retention

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region if needed

def list_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    bad_instances = []

    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            if retention == 0:
                bad_instances.append((name, retention))

    return bad_instances

if __name__ == "__main__":
    instances = list_instances_with_no_backups()
    if not instances:
        print("All RDS instances have backup retention > 0.")
    else:
        print("Instances with BackupRetentionPeriod=0:")
        for name, retention in instances:
            print(f" - {name} (BackupRetentionPeriod={retention})")

3. Remediate: set a proper backup retention period

Pick a standard (e.g., 7 days). Adjust based on your policy.

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region

TARGET_RETENTION_DAYS = 7  # set per your policy

def set_backup_retention(db_instance_id, retention_days):
    print(f"Updating {db_instance_id} to BackupRetentionPeriod={retention_days}")
    response = rds.modify_db_instance(
        DBInstanceIdentifier=db_instance_id,
        BackupRetentionPeriod=retention_days,
        ApplyImmediately=True  # or False to wait for maintenance window
    )
    return response

def fix_all_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            # Only update those with 0 (disabled)
            if retention == 0:
                set_backup_retention(name, TARGET_RETENTION_DAYS)

if __name__ == "__main__":
    fix_all_instances_with_no_backups()

4. Verify remediation

import boto3

rds = boto3.client("rds", region_name="us-east-1")

def verify_retention():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            print(
                db["DBInstanceIdentifier"],
                "-> BackupRetentionPeriod:",
                db.get("BackupRetentionPeriod"),
            )

if __name__ == "__main__":
    verify_retention()

5. Notes

For Aurora clusters, use modify_db_cluster with BackupRetentionPeriod instead:

rds.modify_db_cluster(
    DBClusterIdentifier="my-aurora-cluster",
    BackupRetentionPeriod=7,
    ApplyImmediately=True
)

BackupRetentionPeriod valid range is typically 1–35 (check the engine/region docs if needed).

Using Terraform

resource "aws_db_instance" "THIS_DB" {
  # Replace with your DB instance settings
  identifier        = "YOUR_DB_IDENTIFIER"
  engine            = "mysql"                 # or postgres, etc.
  instance_class    = "db.t3.medium"
  allocated_storage = 20
  username          = "YOUR_MASTER_USERNAME"
  password          = "YOUR_MASTER_PASSWORD"
  db_subnet_group_name = aws_db_subnet_group.this.name

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

If you are using Aurora or another RDS cluster, configure it on the cluster resource:

resource "aws_rds_cluster" "THIS_CLUSTER" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"
  engine             = "aurora-mysql"   # or aurora-postgresql, etc.
  master_username    = "YOUR_MASTER_USERNAME"
  master_password    = "YOUR_MASTER_PASSWORD"

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

Changing backup_retention_period is an in‑place modification and does not force replacement of the DB instance or cluster.After you add or change this argument, terraform plan should show an in-place update with a change like:

backup_retention_period: "0" => "7"

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Backup Retention Duration Should Be Present

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

For an existing RDS DB instance

For a new RDS DB instance

1. Identify RDS Instances with Backup Retention = 0

2. Decide Your Desired Retention Period

3. Remediate Non-Aurora RDS Instances

4. Remediate Aurora Clusters (if using Aurora)

4.1. Find Aurora clusters with retention = 0

4.2. Set retention on each cluster

5. Verify the Change

1. Prerequisites

2. Identify RDS instances with no backup retention

3. Remediate: set a proper backup retention period

4. Verify remediation

5. Notes

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using AWS Console

​Triage and Remediation

​Remediation

​For an existing RDS DB instance

​For a new RDS DB instance

​1. Identify RDS Instances with Backup Retention = 0

​2. Decide Your Desired Retention Period

​3. Remediate Non-Aurora RDS Instances

​4. Remediate Aurora Clusters (if using Aurora)

​4.1. Find Aurora clusters with retention = 0

​4.2. Set retention on each cluster

​5. Verify the Change

​1. Prerequisites

​2. Identify RDS instances with no backup retention

​3. Remediate: set a proper backup retention period

​4. Verify remediation

​5. Notes

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

For an existing RDS DB instance

For a new RDS DB instance

1. Identify RDS Instances with Backup Retention = 0

2. Decide Your Desired Retention Period

3. Remediate Non-Aurora RDS Instances

4. Remediate Aurora Clusters (if using Aurora)

4.1. Find Aurora clusters with retention = 0

4.2. Set retention on each cluster

5. Verify the Change

1. Prerequisites

2. Identify RDS instances with no backup retention

3. Remediate: set a proper backup retention period

4. Verify remediation

5. Notes

Additional Reading: