Skip to main content

More Info:

Checks if a recovery point was created for Amazon Relational Database Service (Amazon RDS). The rule is NON_COMPLIANT if the Amazon RDS instance does not have a corresponding recovery point created within the specified time period.

Risk Level

High

Address

Configuration

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of missing backup recovery points for an AWS RDS instance, you can follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login using your credentials.
  2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top left corner, then select “RDS” under the Database category.
  3. Select the RDS Instance: From the list of RDS instances, click on the instance that you want to enable backup recovery points for.
  4. Enable Automated Backups:
    • In the RDS dashboard for the selected instance, click on the “Modify” button on the top right corner.
    • Scroll down to the “Backup” section.
    • Check the box for “Backup retention period” and set a retention period that suits your requirements (e.g., 7 days, 30 days).
    • Check the box for “Enable automatic backups” to enable automated backups for the RDS instance.
    • You can also configure the backup window timing as per your preference.
  5. Enable Backup Retention:
    • Scroll down further to the “Maintenance” section.
    • Check the box for “Backup retention period” and set a retention period that suits your requirements (e.g., 7 days, 30 days).
  6. Review and Apply Changes:
    • Scroll to the bottom of the page and click on the “Continue” button.
    • Review the changes you have made to ensure they are correct.
    • Click on the “Modify DB Instance” button to apply the changes.
  7. Verify Backup Configuration:
    • Once the modification is complete, go back to the RDS dashboard for the instance.
    • You should see that automated backups are now enabled, and a backup retention period has been set.
By following these steps, you have successfully enabled automated backups and set a backup retention period for your AWS RDS instance, ensuring that backup recovery points are created regularly.

To remediate the misconfiguration of not having backup recovery points created for an AWS RDS instance using AWS CLI, you can follow these steps:
  1. Identify the RDS Instance: First, you need to identify the RDS instance for which you want to enable backup recovery points. You can do this by listing all your RDS instances using the following AWS CLI command:
  2. Enable Automated Backups: To enable automated backups for the RDS instance, you can use the following AWS CLI command. Replace <instance-id> with the actual ID of your RDS instance:
    • --backup-retention-period: Specifies the number of days to retain automated backups. You can adjust this value as needed.
    • --apply-immediately: This flag ensures that the changes take effect immediately.
  3. Verify Backup Configuration: You can verify the backup configuration for the RDS instance by describing the instance using the following AWS CLI command:
    Make sure that the BackupRetentionPeriod is set to the desired value and that BackupRetentionPeriod is not 0.
  4. Monitor Backups: After enabling automated backups, you should monitor the backups to ensure that they are being created as expected. You can view the automated backups for the RDS instance using the following AWS CLI command:
By following these steps, you can remediate the misconfiguration of not having backup recovery points created for an AWS RDS instance using AWS CLI.
To remediate the misconfiguration of not having backup recovery points created for an AWS RDS instance using Python, you can follow these steps:
  1. Import the necessary libraries:
  1. Initialize the AWS RDS client:
  1. Get a list of all RDS instances:
  1. Iterate through each RDS instance and enable automated backups if they are not already enabled:
  1. Verify that automated backups are enabled for all RDS instances:
By following these steps and running the Python script, you can ensure that automated backups are enabled for all your AWS RDS instances, thus remediating the misconfiguration of not having backup recovery points created.
Creating a one-off manual snapshot with a timestamped name (create-db-snapshot ... -manual-snapshot-$(date ...)) is a runtime operation and not something Terraform can safely model (it would try to re-create it on every apply with a static name); run the provided AWS CLI command or use the console for that one-time recovery point.Modifying backup_retention_period is an in-place change and does not force replacement of the DB instance, but it may cause a brief outage when applied, similar to the --apply-immediately behavior.To verify, terraform plan should show an in-place update of aws_db_instance.THIS_DB_INSTANCE with backup_retention_period changing from its previous value (often 0) to 7.

Additional Reading: