Description

Ensure that Amazon RDS clusters (including Aurora clusters) have the Deletion protection setting enabled, so that the cluster cannot be deleted via the console, RDS API, or CLI without first explicitly disabling this protection.

Rationale

Deleting an RDS cluster removes the database and, depending on the final snapshot settings chosen at the time of deletion, may result in permanent data loss if a final snapshot is not taken or is subsequently deleted. Without deletion protection, a single console misclick, scripting error, or compromised credential with sufficient permissions can trigger this action. Enabling deletion protection requires an explicit, deliberate additional step before the cluster can be deleted, protecting against this class of accidental data loss.

Impact

  • Prevents accidental or unauthorized deletion of a critical database cluster and its data

  • Requires an explicit, deliberate action to disable protection before legitimate cluster deletion

  • Adds an extra step to legitimate cluster decommissioning workflows

Default Value

Deletion protection is enabled by default when creating a new RDS cluster via the console, but may be disabled via the CLI/API defaults or by explicit configuration, and should be verified for existing clusters.

Pre-Requisites

  • IAM permissions to modify RDS cluster settings (rds:ModifyDBCluster)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Databases and select the cluster to review.

  3. Open the Configuration tab.

  4. Verify that Deletion protection shows as Enabled.

  5. If Deletion protection is disabled for a production cluster, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Databases and select the cluster to update.

  3. Select Modify.

  4. Under Deletion protection, select Enable deletion protection.

  5. Choose to apply the change immediately (or during the next maintenance window, though this change typically has no downtime impact) and select Continue, then Modify cluster.

  6. Verify the Configuration tab now shows Deletion protection as Enabled.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Databases and select the affected cluster.

  3. Select Modify.

  4. Under Deletion protection, clear Enable deletion protection.

  5. Apply the change and confirm.

Reference