Description

Ensure that every Amazon RDS DB instance is included in an AWS Backup plan so it is backed up on a defined schedule and retention period. Aurora DB instances are not evaluated. An instance is protected only when a backup plan's resource assignment lists its own ARN, the wildcard arn:aws:rds:*:*:instance:* or * (all resources); instances covered only through tag-based resource assignments are reported as unprotected.

Rationale

Without an AWS Backup plan, there is no assurance that a recent, usable backup of the database exists. Accidental deletion, corruption or a malicious wipe can then lead to missed recovery objectives, long outages and data loss. Assigning DB instances to a backup plan that matches the business recovery point and recovery time objectives provides scheduled backups, managed retention and central reporting. Backups should be stored in protected vaults and restores tested regularly.

Impact

  • Provides scheduled, centrally managed backups with defined retention

  • Improves the ability to recover from accidental or malicious data loss

  • AWS Backup storage is charged according to the size and retention of the backups

  • Backup jobs on single-AZ DB instances may cause a brief I/O suspension while the snapshot starts

Default Value

DB instances are not assigned to any AWS Backup plan by default. RDS automated backups are a separate feature and do not count as a backup plan.

Pre-Requisites

  • IAM permissions: backup:ListBackupPlans, backup:CreateBackupPlan, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupSelection, backup:DeleteBackupSelection and iam:PassRole

  • An IAM role that AWS Backup can use to create backups, such as AWSBackupDefaultServiceRole

  • An agreed backup frequency and retention period, and a backup vault to store the backups

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Open each backup plan and review the Resource assignments section.

  4. Check that each non-Aurora RDS DB instance is listed by its ARN in the resources of an assignment, or that an assignment includes all resource types (*). Assignments that select resources by tags do not count.

  5. Repeat for each region in use.

  6. If a DB instance is not included in any backup plan, follow the implementation steps.

CLI:

List the backup plans:

aws backup list-backup-plans --region <REGION> --query "BackupPlansList[].[BackupPlanName,BackupPlanId]" --output table

List the resource assignments of a backup plan:

aws backup list-backup-selections --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --query "BackupSelectionsList[].[SelectionName,SelectionId]" --output table

Show the resources included in a resource assignment:

aws backup get-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID> --query "BackupSelection.Resources"

A non-Aurora DB instance fails if the Resources list of no resource assignment contains its ARN (arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_ID>), the wildcard arn:aws:rds:*:*:instance:* or *. Instances that are only selected through tags or conditions are not recognized as protected, and Aurora DB instances are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Settings.

  3. Under Service opt-in, confirm that RDS is enabled. If not, choose Configure resources, enable it and save.

  4. Select Backup plans and open an existing plan, or choose Create backup plan and define the schedule, retention and backup vault.

  5. In the plan, choose Assign resources.

  6. Enter a Resource assignment name and select the IAM role (for example Default role).

  7. Choose to include specific resource types, select RDS and select the DB instance (or add it by ARN).

  8. Choose Assign resources.

  9. Repeat for each affected DB instance in each region in use.

CLI:

Save the following as backup-selection.json:

{"SelectionName":"<SELECTION_NAME>","IamRoleArn":"arn:aws:iam::<ACCOUNT_ID>:role/service-role/AWSBackupDefaultServiceRole","Resources":["arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_ID>"]}

Assign the DB instance to an existing backup plan:

aws backup create-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --backup-selection file://backup-selection.json

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Open the backup plan and select the resource assignment that was added.

  4. Choose Delete and confirm.

CLI:

aws backup delete-backup-selection --region <REGION> --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID>

Note: removing the assignment stops new scheduled backups of the DB instance. Existing recovery points are kept until their retention period ends.

Reference