Description

Ensure that every Amazon RDS DB cluster, including Amazon Aurora and Multi-AZ DB clusters, has deletion protection enabled. When deletion protection is enabled, the cluster cannot be deleted until the setting is turned off again. Amazon DocumentDB clusters are not covered by this check.

Rationale

Without deletion protection, a DB cluster can be deleted by mistake, by faulty automation or by a compromised identity, causing an immediate outage and possible data loss if backups are missing or out of date. Enabling deletion protection on production and other critical clusters adds a deliberate extra step before a cluster can be removed. It should be combined with least-privilege access to delete and modify actions, change control, and reliable backups.

Impact

  • Prevents accidental or malicious deletion of the DB cluster

  • Enabling the setting does not cause downtime and does not affect database connections

  • Teams and automation that intentionally delete clusters (for example, test environments) must first disable deletion protection

Default Value

Deletion protection is disabled by default when a DB cluster is created with the AWS CLI or API, unless it is explicitly enabled.

Pre-Requisites

  • IAM permissions: rds:DescribeDBClusters and rds:ModifyDBCluster

  • A list of the clusters that are intentionally short-lived and may need to stay deletable

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select each database whose role is a cluster (for example, Regional cluster or Multi-AZ DB cluster) and open the Configuration tab.

  4. Check that Deletion protection is Enabled.

  5. Repeat for each region in use.

  6. If deletion protection is disabled for any cluster, follow the implementation steps.

CLI:

List all DB clusters with their engine and deletion protection setting:

aws rds describe-db-clusters --region <REGION> --query "DBClusters[].[DBClusterIdentifier,Engine,DeletionProtection]" --output table

A cluster fails if DeletionProtection is False. Clusters with the docdb engine are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select the DB cluster and choose Modify.

  4. Select Enable deletion protection.

  5. Choose Continue, select Apply immediately, then choose Modify cluster.

  6. Repeat for each affected cluster in each region in use.

CLI:

Enable deletion protection on a DB cluster:

aws rds modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --deletion-protection --apply-immediately --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select the DB cluster and choose Modify.

  4. Clear Enable deletion protection.

  5. Choose Continue, select Apply immediately, then choose Modify cluster.

CLI:

aws rds modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --no-deletion-protection --apply-immediately --region <REGION>

Note: rolling back allows the cluster to be deleted again without any extra step.

Reference