# Ensure RDS instances have backup enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292218384620-ensure-rds-instances-have-backup-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon RDS DB instance has automated backups enabled, which means its backup retention period is set to 1 day or more. Automated backups take a daily snapshot of the instance and keep its transaction logs, allowing the database to be restored to any point in time within the retention period. Read replicas are not evaluated. **Rationale** Without automated backups, a DB instance cannot be restored to an earlier point in time. Accidental deletions, faulty queries, data corruption or a compromised account can then cause permanent data loss and long outages. Enabling automated backups with a retention period that matches the business recovery objectives allows reliable recovery during incidents. Restores should also be tested regularly. **Impact** - Enables point-in-time recovery of the database within the retention period - Protects against accidental or malicious data loss - Changing the retention period from 0 to a non-zero value causes a short outage of the DB instance, so plan the change for a maintenance window - Backup storage beyond the free allowance is charged **Default Value** Automated backups are enabled by default. The RDS console uses a default retention period of 7 days, and the API and CLI use a default of 1 day. Backups are disabled only if the retention period was explicitly set to 0. **Pre-Requisites** - IAM permissions: rds:DescribeDBInstances and rds:ModifyDBInstance - An agreed backup retention period (1 to 35 days) based on the recovery point objective - A maintenance window for the change, because enabling backups causes a short outage **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon RDS console and select **Databases**. 3. Select a DB instance and open the **Maintenance & backups** tab. 4. In the **Backup** section, check that **Automated backups** is **Enabled** and the retention period is 1 day or more. 5. Repeat for each DB instance in each region in use. Read replicas can be skipped. 6. If automated backups are disabled, follow the implementation steps. **CLI:** Show the backup retention period of all DB instances: aws rds describe-db-instances --region --query "DBInstances\[\].\[DBInstanceIdentifier,BackupRetentionPeriod,ReadReplicaSourceDBInstanceIdentifier\]" --output table A DB instance fails if its BackupRetentionPeriod is 0. Instances with a value in the third column are read replicas and are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon RDS console and select **Databases**. 3. Select the DB instance found in the Test Plan and choose **Modify**. 4. In the **Backup** section (under **Additional configuration**), set **Backup retention period** to 1 day or more, for example 7 days. 5. Choose **Continue**. 6. Under **Schedule modifications**, select **Apply immediately** or apply the change during the next maintenance window. 7. Choose **Modify DB instance**. 8. Repeat for each affected DB instance in each region in use. **CLI:** Enable automated backups with a 7-day retention period: aws rds modify-db-instance --region --db-instance-identifier --backup-retention-period 7 --apply-immediately **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon RDS console, select the DB instance and choose **Modify**. 3. Set **Backup retention period** back to the previous value (0 days to disable backups). 4. Choose **Continue**, select when to apply the change, then choose **Modify DB instance**. **CLI:** aws rds modify-db-instance --region --db-instance-identifier --backup-retention-period 0 --apply-immediately Note: setting the retention period to 0 deletes the existing automated backups, causes a short outage and removes point-in-time recovery. Take a manual snapshot first if a restore point is needed. **Reference** - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_WorkingWithAutomatedBackups.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html) - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_WorkingWithAutomatedBackups.Enabling.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Enabling.html) - [https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.