Description

Ensure that every Amazon RDS DB instance has automated backups enabled, which means its backup retention period is set to 1 day or more. Automated backups take a daily snapshot of the instance and keep its transaction logs, allowing the database to be restored to any point in time within the retention period. Read replicas are not evaluated.

Rationale

Without automated backups, a DB instance cannot be restored to an earlier point in time. Accidental deletions, faulty queries, data corruption or a compromised account can then cause permanent data loss and long outages. Enabling automated backups with a retention period that matches the business recovery objectives allows reliable recovery during incidents. Restores should also be tested regularly.

Impact

  • Enables point-in-time recovery of the database within the retention period

  • Protects against accidental or malicious data loss

  • Changing the retention period from 0 to a non-zero value causes a short outage of the DB instance, so plan the change for a maintenance window

  • Backup storage beyond the free allowance is charged

Default Value

Automated backups are enabled by default. The RDS console uses a default retention period of 7 days, and the API and CLI use a default of 1 day. Backups are disabled only if the retention period was explicitly set to 0.

Pre-Requisites

  • IAM permissions: rds:DescribeDBInstances and rds:ModifyDBInstance

  • An agreed backup retention period (1 to 35 days) based on the recovery point objective

  • A maintenance window for the change, because enabling backups causes a short outage

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select a DB instance and open the Maintenance & backups tab.

  4. In the Backup section, check that Automated backups is Enabled and the retention period is 1 day or more.

  5. Repeat for each DB instance in each region in use. Read replicas can be skipped.

  6. If automated backups are disabled, follow the implementation steps.

CLI:

Show the backup retention period of all DB instances:

aws rds describe-db-instances --region <REGION> --query "DBInstances[].[DBInstanceIdentifier,BackupRetentionPeriod,ReadReplicaSourceDBInstanceIdentifier]" --output table

A DB instance fails if its BackupRetentionPeriod is 0. Instances with a value in the third column are read replicas and are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select the DB instance found in the Test Plan and choose Modify.

  4. In the Backup section (under Additional configuration), set Backup retention period to 1 day or more, for example 7 days.

  5. Choose Continue.

  6. Under Schedule modifications, select Apply immediately or apply the change during the next maintenance window.

  7. Choose Modify DB instance.

  8. Repeat for each affected DB instance in each region in use.

CLI:

Enable automated backups with a 7-day retention period:

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB_INSTANCE_ID> --backup-retention-period 7 --apply-immediately

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console, select the DB instance and choose Modify.

  3. Set Backup retention period back to the previous value (0 days to disable backups).

  4. Choose Continue, select when to apply the change, then choose Modify DB instance.

CLI:

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB_INSTANCE_ID> --backup-retention-period 0 --apply-immediately

Note: setting the retention period to 0 deletes the existing automated backups, causes a short outage and removes point-in-time recovery. Take a manual snapshot first if a restore point is needed.

Reference