# Ensure RDS cluster has deletion protection enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_179329224560037-ensure-rds-cluster-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon RDS DB cluster, including Amazon Aurora and Multi-AZ DB clusters, has deletion protection enabled. When deletion protection is enabled, the cluster cannot be deleted until the setting is turned off again. Amazon DocumentDB clusters are not covered by this check.

**Rationale**

Without deletion protection, a DB cluster can be deleted by mistake, by faulty automation or by a compromised identity, causing an immediate outage and possible data loss if backups are missing or out of date. Enabling deletion protection on production and other critical clusters adds a deliberate extra step before a cluster can be removed. It should be combined with least-privilege access to delete and modify actions, change control, and reliable backups.

**Impact**

-   Prevents accidental or malicious deletion of the DB cluster
    
-   Enabling the setting does not cause downtime and does not affect database connections
    
-   Teams and automation that intentionally delete clusters (for example, test environments) must first disable deletion protection
    

**Default Value**

Deletion protection is disabled by default when a DB cluster is created with the AWS CLI or API, unless it is explicitly enabled.

**Pre-Requisites**

-   IAM permissions: rds:DescribeDBClusters and rds:ModifyDBCluster
    
-   A list of the clusters that are intentionally short-lived and may need to stay deletable
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console and select **Databases**.
    
3.  Select each database whose role is a cluster (for example, **Regional cluster** or **Multi-AZ DB cluster**) and open the **Configuration** tab.
    
4.  Check that **Deletion protection** is **Enabled**.
    
5.  Repeat for each region in use.
    
6.  If deletion protection is disabled for any cluster, follow the implementation steps.
    

**CLI:**

List all DB clusters with their engine and deletion protection setting:

aws rds describe-db-clusters --region <REGION> --query "DBClusters\[\].\[DBClusterIdentifier,Engine,DeletionProtection\]" --output table

A cluster fails if DeletionProtection is False. Clusters with the docdb engine are not evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console and select **Databases**.
    
3.  Select the DB cluster and choose **Modify**.
    
4.  Select **Enable deletion protection**.
    
5.  Choose **Continue**, select **Apply immediately**, then choose **Modify cluster**.
    
6.  Repeat for each affected cluster in each region in use.
    

**CLI:**

Enable deletion protection on a DB cluster:

aws rds modify-db-cluster --db-cluster-identifier <DB\_CLUSTER\_ID> --deletion-protection --apply-immediately --region <REGION>

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console and select **Databases**.
    
3.  Select the DB cluster and choose **Modify**.
    
4.  Clear **Enable deletion protection**.
    
5.  Choose **Continue**, select **Apply immediately**, then choose **Modify cluster**.
    

**CLI:**

aws rds modify-db-cluster --db-cluster-identifier <DB\_CLUSTER\_ID> --no-deletion-protection --apply-immediately --region <REGION>

Note: rolling back allows the cluster to be deleted again without any extra step.

**Reference**

-   [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_DeleteInstance.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html)
    
-   [https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster.html](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.