# Ensure RDS instances are protected by an AWS Backup plan - Source: https://support.icompaas.com/support/solutions/articles/a_179329221988543-ensure-rds-instances-are-protected-by-an-aws-backup-plan - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon RDS DB instance is included in an AWS Backup plan so it is backed up on a defined schedule and retention period. Aurora DB instances are not evaluated. An instance is protected only when a backup plan's resource assignment lists its own ARN, the wildcard arn:aws:rds:\*:\*:instance:\* or \* (all resources); instances covered only through tag-based resource assignments are reported as unprotected. **Rationale** Without an AWS Backup plan, there is no assurance that a recent, usable backup of the database exists. Accidental deletion, corruption or a malicious wipe can then lead to missed recovery objectives, long outages and data loss. Assigning DB instances to a backup plan that matches the business recovery point and recovery time objectives provides scheduled backups, managed retention and central reporting. Backups should be stored in protected vaults and restores tested regularly. **Impact** - Provides scheduled, centrally managed backups with defined retention - Improves the ability to recover from accidental or malicious data loss - AWS Backup storage is charged according to the size and retention of the backups - Backup jobs on single-AZ DB instances may cause a brief I/O suspension while the snapshot starts **Default Value** DB instances are not assigned to any AWS Backup plan by default. RDS automated backups are a separate feature and do not count as a backup plan. **Pre-Requisites** - IAM permissions: backup:ListBackupPlans, backup:CreateBackupPlan, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupSelection, backup:DeleteBackupSelection and iam:PassRole - An IAM role that AWS Backup can use to create backups, such as AWSBackupDefaultServiceRole - An agreed backup frequency and retention period, and a backup vault to store the backups **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Open each backup plan and review the **Resource assignments** section. 4. Check that each non-Aurora RDS DB instance is listed by its ARN in the resources of an assignment, or that an assignment includes all resource types (\*). Assignments that select resources by tags do not count. 5. Repeat for each region in use. 6. If a DB instance is not included in any backup plan, follow the implementation steps. **CLI:** List the backup plans: aws backup list-backup-plans --region --query "BackupPlansList\[\].\[BackupPlanName,BackupPlanId\]" --output table List the resource assignments of a backup plan: aws backup list-backup-selections --region --backup-plan-id --query "BackupSelectionsList\[\].\[SelectionName,SelectionId\]" --output table Show the resources included in a resource assignment: aws backup get-backup-selection --region --backup-plan-id --selection-id --query "BackupSelection.Resources" A non-Aurora DB instance fails if the Resources list of no resource assignment contains its ARN (arn:aws:rds:::db:), the wildcard arn:aws:rds:\*:\*:instance:\* or \*. Instances that are only selected through tags or conditions are not recognized as protected, and Aurora DB instances are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Settings**. 3. Under **Service opt-in**, confirm that **RDS** is enabled. If not, choose **Configure resources**, enable it and save. 4. Select **Backup plans** and open an existing plan, or choose **Create backup plan** and define the schedule, retention and backup vault. 5. In the plan, choose **Assign resources**. 6. Enter a **Resource assignment name** and select the IAM role (for example **Default role**). 7. Choose to include specific resource types, select **RDS** and select the DB instance (or add it by ARN). 8. Choose **Assign resources**. 9. Repeat for each affected DB instance in each region in use. **CLI:** Save the following as backup-selection.json: {"SelectionName":"","IamRoleArn":"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole","Resources":\["arn:aws:rds:::db:"\]} Assign the DB instance to an existing backup plan: aws backup create-backup-selection --region --backup-plan-id --backup-selection file://backup-selection.json **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Open the backup plan and select the resource assignment that was added. 4. Choose **Delete** and confirm. **CLI:** aws backup delete-backup-selection --region --backup-plan-id --selection-id Note: removing the assignment stops new scheduled backups of the DB instance. Existing recovery points are kept until their retention period ends. **Reference** - [https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html) - [https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html) - [https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html) - [https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-selection.html](https://docs.aws.amazon.com/cli/latest/reference/backup/create-backup-selection.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.