# Ensure to Enable Backup and Recovery

- Source: https://support.icompaas.com/support/solutions/articles/62000234439-ensure-to-enable-backup-and-recovery
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112688) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169253)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: Level 1

Description:  
Enabling backup and recovery ensures that critical database data can be restored in the event of an accidental deletion, corruption, or disaster. AWS database services like RDS, QLDB, and DocumentDB offer built-in features to automate and manage backups effectively.

Rationale:  
Having backup and disaster recovery mechanisms in place helps mitigate the impact of data loss, supports business continuity, and ensures data durability and compliance with industry standards.

Impact:  
Without backup and recovery, organizations risk permanent data loss, operational disruption, and potential compliance violations.

Default Value:  
Backups may not be enabled by default. Each AWS database service (e.g., RDS, QLDB, DocumentDB) requires configuration for backup policies.

Pre-requisites:

-   A running database instance or cluster in AWS  
      
    
-   IAM permissions to modify backup settings  
      
    

### Test Plan

Using AWS Console:

1.  Sign in to the AWS Management Console  
      
    
2.  Navigate to the respective database service console (e.g., RDS, QLDB, DocumentDB)  
      
    
3.  Select the target database  
      
    
4.  Verify that automated backups are enabled and a retention window is set  
    

  

Using AWS CLI:

1.  Check backup status for RDS:  
    
     aws rds describe-db-instances --query "DBInstances\[\*\].BackupRetentionPeriod"
    
      
    
2.  Check QLDB backup configuration (no direct CLI command; confirm journal export setup)  
      
    
3.  Check DocumentDB backup settings:  
    
     aws docdb describe-db-clusters --query "DBClusters\[\*\].BackupRetentionPeriod"
    
      
    

  
Implementation Plan

Using AWS Console:

1.  Sign in to the AWS Management Console  
      
    
2.  Navigate to RDS, QLDB, or DocumentDB service  
      
    
3.  Select the target database  
      
    
4.  Click Modify or go to Configuration tab  
      
    
5.  Enable Automated Backups  
      
    
6.  Set the desired backup retention period (e.g., 7 days)  
      
    
7.  Save the changes  
      
    

Using AWS CLI:

1.  For RDS:  
    
     aws rds modify-db-instance --db-instance-identifier <instance-id> --backup-retention-period 7 --apply-immediately
    
      
    
2.  For DocumentDB:  
    
     aws docdb modify-db-cluster --db-cluster-identifier <cluster-id> --backup-retention-period 7 --apply-immediately
    
      
      
    
3.  For QLDB, set journal export and backup via the console or custom Lambda (CLI options are limited)  
      
    

### Backout Plan

Using AWS Console:

1.  Sign in to the AWS Management Console  
      
    
2.  Navigate to the respective service  
      
    
3.  Select the database  
      
    
4.  Click Modify  
      
    
5.  Set the backup retention period to 0 to disable backups  
      
    
6.  Save the changes  
      
    

Using AWS CLI:

1.  For RDS:  
    
     aws rds modify-db-instance --db-instance-identifier <instance-id> --backup-retention-period 0 --apply-immediately
    
      
    
2.  For DocumentDB:  
    
     aws docdb modify-db-cluster --db-cluster-identifier <cluster-id> --backup-retention-period 0 --apply-immediately
    
      
    

References:

-   [https://aws.amazon.com/products/databases/  
    ](https://aws.amazon.com/products/databases/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.