Open menu
-->

Enable AWS RDS Deletion Protection

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Security

Risk level: Medium (should be achieved)

Ensure that your Amazon Relational Database Service (RDS) instances have Deletion Protection feature enabled in order to protect them from being accidentally deleted. Deletion protection is supported by all AWS RDS engines as well as the Aurora MySQL and Aurora PostgreSQL database engines.

With Deletion Protection safety feature enabled, you have the guarantee that your AWS RDS database instances cannot be accidentally deleted and make sure that your data remains safe. Deletion protection prevents any existing or new RDS database instances from being deleted by a user using the AWS Management Console, using CLI or API calls unless the feature is explicitly disabled.

Audit

To determine if your Amazon RDS database instances are protected against accidental deletion, perform the following:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to RDS dashboard at https://console.aws.amazon.com/rds/.

03 In the left navigation panel, under Amazon RDS, click Instances.

04 Choose the RDS database instance that you want to examine and click on the resource name (link) available in the DB instance column.

05 Within Details panel section, in the Configurations category, check the Deletion protection configuration attribute value. If the attribute value is set to Disabled, the Deletion Protection safety feature is not enabled for the selected AWS RDS database instance.

06 Repeat step no. 4 and 5 to verify the Deletion Protection feature status for other AWS RDS instances provisioned in the current region.

07 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run describe-db-instances command (OSX/Linux/UNIX) using custom query filters to list the names (identifiers) of all RDS database instances available in the selected AWS region:

aws rds describe-db-instances
	--region us-east-1
	--output table
	--query 'DBInstances[*].DBInstanceIdentifier'

02 The command output should return a table with the requested RDS names:

-----------------------------
|    DescribeDBInstances    |
+---------------------------+
|  cc-project5-db-instance  |
|  cc-aurora-db-instance    |
+---------------------------+

03 Run describe-db-instances command (OSX/Linux/UNIX) using the name of the database instance that you want to examine as identifier and custom query filters to get the Deletion Protection feature status for the selected AWS RDS resource:

aws rds describe-db-instances
	--region us-east-1
	--db-instance-identifier cc-project5-db-instance
	--query 'DBInstances[*].DeletionProtection'

04 The command output should return the feature status (true for enabled, false for disabled):

[
    false
]

If the describe-db-instances command output returns false, as shown in the output example above, the Deletion Protection safety feature is not enabled for the selected Amazon RDS database instance.

05 Repeat step no. 3 and 4 to check the Deletion Protection feature status for other AWS RDS instances available within the selected region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the audit process for other regions.

Remediation / Resolution

To enable Deletion Protection feature for your existing AWS RDS database instances, perform the following actions:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to RDS dashboard at https://console.aws.amazon.com/rds/.

03 In the left navigation panel, under Amazon RDS, click Instances.

04 Select the RDS database instance that you want to reconfigure (see Audit section part I to identify the right RDS resource).

05 Click the Instance Actions button from the dashboard top menu and select Modify.

06 On the Modify DB Instance: <instance-identifier> page, in the Deletion protection section, select Enable deletion protection checkbox to activate Deletion Protection safety feature for the selected RDS instance.

07 Click Continue to continue the reconfiguration process.

08 Within Summary of modifications section, carefully review the configuration changes that you want to apply to the instance.

09 In the Scheduling of modifications section, perform one of the following actions based on your requirements:

  1. Select Apply during the next scheduled maintenance window to apply the changes automatically during the next scheduled maintenance window.
  2. Select Apply immediately to apply the changes right away. With this option any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this RDS database instance. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your application.

10 Click Modify DB Instance to save your configuration changes.

11 Repeat steps no. 4 – 10 to enable the feature for other AWS RDS database instances available in the current region.

12 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run modify-db-instance command (OSX/Linux/UNIX) to enable Deletion Protection safety feature for the selected RDS database instance (see Audit section part II to identify the right database). The following command example make use of --apply-immediately parameter to apply the configuration changes asynchronously, as soon as possible. Any changes available in the pending modifications queue are also applied with this request. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your application. If you skip adding the --apply-immediately parameter to the command request, Amazon RDS service will apply your changes during the next maintenance window:

aws rds modify-db-instance
	--region us-east-1
	--db-instance-identifier cc-project5-db-instance
	--deletion-protection
	--apply-immediately

02 The command output should return the new configuration metadata for the modified RDS database instance:

{
    "DBInstance": {
        "PubliclyAccessible": true,
        "Engine": "mysql",
        "MultiAZ": false,
        "LatestRestorableTime": "2018-10-12T09:20:00Z",
        "PerformanceInsightsEnabled": false,
        "AutoMinorVersionUpgrade": true,
        "PreferredBackupWindow": "10:46-11:16",
        "AllocatedStorage": 120,
        "BackupRetentionPeriod": 7,
        "PreferredMaintenanceWindow": "fri:09:33-fri:10:03",

        ...

        "DBInstanceStatus": "available",
        "ReadReplicaDBInstanceIdentifiers": [],
        "EngineVersion": "5.6.40",
        "DeletionProtection": true,
        "AvailabilityZone": "us-east-1a",
        "StorageType": "gp2",
        "DbiResourceId": "db-AAAAAABBBBBBCCCCCCDDDDDD",
        "CACertificateIdentifier": "rds-ca-2015",
        "DBInstanceClass": "db.m3.medium",
        "DbInstancePort": 0,
        "DBInstanceIdentifier": "cc-project5-db-instance"
    }
}

03 Repeat step no. 1 and 2 to enable the safety feature for other AWS RDS database instances available within the current region.

04 Change the AWS region by updating the --region command parameter value and repeat the entire process for other regions.

References

Publication date Oct 29, 2018