Profile Applicability: Level 1

Description:
Enabling backup and recovery ensures that critical database data can be restored in the event of an accidental deletion, corruption, or disaster. AWS database services like RDS, QLDB, and DocumentDB offer built-in features to automate and manage backups effectively.

Rationale:
Having backup and disaster recovery mechanisms in place helps mitigate the impact of data loss, supports business continuity, and ensures data durability and compliance with industry standards.

Impact:
Without backup and recovery, organizations risk permanent data loss, operational disruption, and potential compliance violations.

Default Value:
Backups may not be enabled by default. Each AWS database service (e.g., RDS, QLDB, DocumentDB) requires configuration for backup policies.

Pre-requisites:

  • A running database instance or cluster in AWS

  • IAM permissions to modify backup settings

Test Plan

Using AWS Console:

  1. Sign in to the AWS Management Console

  2. Navigate to the respective database service console (e.g., RDS, QLDB, DocumentDB)

  3. Select the target database

  4. Verify that automated backups are enabled and a retention window is set


Using AWS CLI:

  1. Check backup status for RDS:

     aws rds describe-db-instances --query "DBInstances[*].BackupRetentionPeriod"


  2. Check QLDB backup configuration (no direct CLI command; confirm journal export setup)

  3. Check DocumentDB backup settings:

     aws docdb describe-db-clusters --query "DBClusters[*].BackupRetentionPeriod"



Implementation Plan

Using AWS Console:

  1. Sign in to the AWS Management Console

  2. Navigate to RDS, QLDB, or DocumentDB service

  3. Select the target database

  4. Click Modify or go to Configuration tab

  5. Enable Automated Backups

  6. Set the desired backup retention period (e.g., 7 days)

  7. Save the changes

Using AWS CLI:

  1. For RDS:

     aws rds modify-db-instance --db-instance-identifier <instance-id> --backup-retention-period 7 --apply-immediately


  2. For DocumentDB:

     aws docdb modify-db-cluster --db-cluster-identifier <cluster-id> --backup-retention-period 7 --apply-immediately



  3. For QLDB, set journal export and backup via the console or custom Lambda (CLI options are limited)

Backout Plan

Using AWS Console:

  1. Sign in to the AWS Management Console

  2. Navigate to the respective service

  3. Select the database

  4. Click Modify

  5. Set the backup retention period to 0 to disable backups

  6. Save the changes

Using AWS CLI:

  1. For RDS:

     aws rds modify-db-instance --db-instance-identifier <instance-id> --backup-retention-period 0 --apply-immediately


  2. For DocumentDB:

     aws docdb modify-db-cluster --db-cluster-identifier <cluster-id> --backup-retention-period 0 --apply-immediately


References: