acquires Cloud Conformity
Open menu

Cluster Deletion Protection

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Knowledge Base Best practice rules for Amazon Web Services AWS RDS Best Practices Cluster Deletion Protection
Last updated: 16 May 2019
Security
Risk level: Medium (should be achieved)
Rule ID: RDS-035

Ensure that all your Amazon Aurora databases are protected from accidental deletion by having Deletion Protection feature enabled at the Aurora database cluster level.

This rule can help you with the following compliance standards:

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Deletion protection prevents any existing or new Aurora database cluster, regardless of its type - provisioned or serverless, from being terminated by a root or IAM user using the AWS Management Console, AWS CLI or AWS API calls, unless the feature is explicitly disabled. With Deletion Protection safety feature enabled, you have the certainty that your Amazon Aurora cluster cannot be accidentally deleted and make sure that your data remains safe.

Audit

To determine if your Aurora database clusters are protected against accidental deletion, perform the following actions:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to RDS dashboard at https://console.aws.amazon.com/rds/.

03 In the left navigation panel, under Amazon RDS, click Databases.

04 Click on the name (link) of the Aurora database cluster that you want to examine. To identify Aurora clusters, check the value available in the Engine column (e.g. Aurora MySQL).

05 On the cluster details page, select Configuration tab and check the Deletion protection configuration attribute value. If the attribute value is set to Disabled, the Deletion Protection safety feature is not enabled for the selected Amazon Aurora database cluster.

06 Repeat step no. 4 and 5 to determine the Deletion Protection feature status for other Amazon Aurora clusters available in the current region.

07 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run describe-db-clusters command (OSX/Linux/UNIX) using custom query filters to list the names of all Aurora database clusters available in the selected AWS region: 

aws rds describe-db-clusters
	--region us-east-1
	--output table
	--query 'DBClusters[?Engine==`aurora`].DBClusterIdentifier | []'

02 The command output should return a table with the requested RDS resource names: 

----------------------------
|  DescribeDBClusters      |
+--------------------------+
|  cc-project5-cluster     |
|  cc-serverless-cluster   |
+--------------------------+

03 Execute again describe-db-clusters command (OSX/Linux/UNIX) using the name of the database cluster that you want to examine as identifier and custom query filters to get the Deletion Protection feature status for the selected Amazon Aurora cluster: 

aws rds describe-db-clusters
	--region us-east-1
	--db-cluster-identifier cc-project5-cluster
	--query 'DBClusters[*].DeletionProtection'

04 The command output should return the feature status (true for enabled, false for disabled): 

[
    false
]

If the describe-db-clusters command output returns false, as shown in the output example above, the Deletion Protection safety feature is not enabled for the selected Amazon Aurora database cluster.

05 Repeat step no. 3 and 4 to check the Deletion Protection feature status for other Aurora clusters available within the selected region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the audit process for other regions.

Remediation / Resolution

To enable Deletion Protection feature for your existing Amazon Aurora database clusters (provisioned and serverless), perform the following actions:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to RDS dashboard at https://console.aws.amazon.com/rds/.

03 In the left navigation panel, under Amazon RDS, click Databases.

04 Select the database cluster that you want to reconfigure (see Audit section part I to identify the right Amazon Aurora resource).

05 Click the Modify button from the dashboard top menu.

06 On the Modify DB Cluster: <cluster-identifier> page, in the Deletion protection section, select Enable deletion protection checkbox to activate Deletion Protection for the selected Amazon Aurora cluster.

07 Click Continue to continue the reconfiguration process.

08 Within Summary of modifications section, review the configuration changes that you want to apply to the cluster.

09 In the Scheduling of modifications section, perform one of the following actions based on your requirements:

  1. Select Apply during the next scheduled maintenance window to apply the changes automatically during the next scheduled maintenance window.
  2. Select Apply immediately to apply the changes right away. With this option any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this Aurora database cluster. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your application.

10 Click Modify DB Cluster to apply the configuration changes.

11 Repeat steps no. 4 – 10 to enable the feature for other Amazon Aurora clusters available in the current region.

12 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run modify-db-cluster command (OSX/Linux/UNIX) to enable Deletion Protection feature for the selected Amazon Aurora database cluster (see Audit section part II to identify the right resource) by adding the --deletion-protection parameter to the command request. The following command example make use of --apply-immediately parameter to apply the configuration changes asynchronously and as soon as possible. Any changes available in the pending modifications queue are also applied with this request. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your Aurora-based application. If you skip adding the --apply-immediately parameter to the command request, Amazon Aurora will apply your changes during the next maintenance window: 

aws rds modify-db-cluster
	--region us-east-1
	--db-cluster-identifier cc-project5-cluster
	--deletion-protection
	--apply-immediately

02 The command output should return the new configuration metadata for the modified serverless cluster: 

{
    "DBCluster": {
		"Status": "available",
		"MultiAZ": false,
		"PreferredBackupWindow": "05:07-05:37",
		"DBSubnetGroup": "default",
		"BackupRetentionPeriod": 7,
		"Engine": "aurora",
		"IAMDatabaseAuthenticationEnabled": false,
		"ClusterCreateTime": "2019-04-10T10:14:45.332Z",
		"EngineVersion": "5.6.10a",

		...

		"DeletionProtection": true,
		"DBClusterIdentifier": "cc-project5-cluster",
		"DbClusterResourceId": "cluster-AAAABBBBCCCCDDDDAAAABBBBCD",
		"DBClusterMembers": [],
		"StorageEncrypted": true,
		"DBClusterParameterGroup": "default.aurora5.6",
		"AvailabilityZones": [
			"us-east-1a",
			"us-east-1c"
		],
		"Port": 3306
    }
}

03 Repeat step no. 1 and 2 to enable the safety feature for other Amazon Aurora database clusters available in the selected region.

04 Change the AWS region by updating the --region command parameter value and repeat the entire process for other regions.

References

Publication date Apr 18, 2019

Related RDS rules

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to