Description: 

RDS is a web service that makes it easier to set up, operate, and scale a relational database in the AWS Cloud. It provides cost-efficient, resizable capacity for an industry-standard relational database and manages common database administration tasks. The policy checks if RDS storage service has controlled access and its backup schedules are configured.


Remediation: 

Amazon RDS creates and saves automated backups of your DB instance during the backup window of your DB instance. RDS creates a storage volume snapshot of your DB instance, backing up the entire DB instance and not just individual databases. RDS saves the automated backups of your DB instance according to the backup retention period that you specify. If necessary, you can recover your database to any point in time during the backup retention period.


Automated backups follow these rules:

  • Your DB instance must be in the AVAILABLE state for automated backups to occur. Automated backups don't occur while your DB instance is in a state other than AVAILABLE, for example STORAGE_FULL.
  • Automated backups and automated snapshots don't occur while a copy is executing in the same region for the same DB instance.


You can also back up your DB instance manually, by manually creating a DB snapshot. For more information about creating a DB snapshot, see Creating a DB Snapshot.


The first snapshot of a DB instance contains the data for the full DB instance. Subsequent snapshots of the same DB instance are incremental, which means that only the data that has changed after your most recent snapshot is saved.


You can copy both automatic and manual DB snapshots, and share manual DB snapshots. For more information about copying a DB snapshot, see Copying a Snapshot. For more information about sharing a DB snapshot, see Sharing a DB Snapshot.


Backup Storage

Your Amazon RDS backup storage for each region is composed of the automated backups and manual DB snapshots for that region. Total backup storage space equals the sum of the storage for all backups in that region. Moving a DB snapshot to another region increases the backup storage in the destination region. Backups are stored in Amazon S3.



If you chose to retain automated backups when you delete a DB instance, the automated backups are saved for the full retention period. If you don't choose to Retain automated backups when you delete a DB instance, all automated backups are deleted with the DB instance. After they are deleted, the automated backups can't be recovered. If you choose to have Amazon RDS create a final DB snapshot before it deletes your DB instance, you can use that to recover your DB instance. Or you can use a previously created manual snapshot. Manual snapshots are not deleted. You can have up to 100 manual snapshots per region.


Enabling Automated Backups

If your DB instance doesn't have automated backups enabled, you can enable them at any time. You enable automated backups by setting the backup retention period to a positive non-zero value. When automated backups are enabled, your RDS instance and database is taken offline and a backup is immediately created.


In this example, you enable automated backups for a DB instance named mydbinstance by setting the backup retention period to a positive non-zero value


To enable automated backups immediately

  1. Sign in to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/.
  2. In the navigation pane, choose Databases, and then choose the DB instance that you want to modify.
  3. Choose Modify. The Modify DB Instance page appears.
  4. For Backup Retention Period, choose a positive nonzero value, for example 3 days.
  5. Choose Continue.
  6. Choose Apply Immediately.
  7. On the confirmation page, choose Modify DB Instance to save your changes and enable automated backups.


Reference: 

    https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html