# Ensure RDS Cluster Has Deletion Protection Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890043815127-ensure-rds-cluster-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon RDS clusters (including Aurora clusters) have the Deletion protection setting enabled, so that the cluster cannot be deleted via the console, RDS API, or CLI without first explicitly disabling this protection.

**Rationale**

Deleting an RDS cluster removes the database and, depending on the final snapshot settings chosen at the time of deletion, may result in permanent data loss if a final snapshot is not taken or is subsequently deleted. Without deletion protection, a single console misclick, scripting error, or compromised credential with sufficient permissions can trigger this action. Enabling deletion protection requires an explicit, deliberate additional step before the cluster can be deleted, protecting against this class of accidental data loss.

**Impact**

-   Prevents accidental or unauthorized deletion of a critical database cluster and its data
    
-   Requires an explicit, deliberate action to disable protection before legitimate cluster deletion
    
-   Adds an extra step to legitimate cluster decommissioning workflows
    

**Default Value**

Deletion protection is enabled by default when creating a new RDS cluster via the console, but may be disabled via the CLI/API defaults or by explicit configuration, and should be verified for existing clusters.

**Pre-Requisites**

-   IAM permissions to modify RDS cluster settings (rds:ModifyDBCluster)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon RDS > Databases and select the cluster to review.
    
3.  Open the Configuration tab.
    
4.  Verify that Deletion protection shows as Enabled.
    
5.  If Deletion protection is disabled for a production cluster, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon RDS > Databases and select the cluster to update.
    
3.  Select Modify.
    
4.  Under Deletion protection, select Enable deletion protection.
    
5.  Choose to apply the change immediately (or during the next maintenance window, though this change typically has no downtime impact) and select Continue, then Modify cluster.
    
6.  Verify the Configuration tab now shows Deletion protection as Enabled.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon RDS > Databases and select the affected cluster.
    
3.  Select Modify.
    
4.  Under Deletion protection, clear Enable deletion protection.
    
5.  Apply the change and confirm.
    

**Reference**

-   [https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-deletion-protection.html](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-deletion-protection.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.