Enable Deletion Protection for Aurora Serverless Clusters

Risk Level: Medium (should be achieved)

Ensure that all your Amazon Aurora Serverless databases are protected from accidental deletion by having the Deletion Protection feature enabled at the cluster level.

Security

Deletion protection prevents any existing or new Aurora Serverless database clusters from being terminated by the root user or an IAM user, using the AWS Management Console, AWS CLI, or AWS API, unless the feature is explicitly disabled. With the Deletion Protection safety feature enabled, you have the certainty that your Amazon Aurora Serverless databases can't be accidentally deleted and make sure that your data remains safe.

Audit

To determine if your Aurora Serverless database clusters are protected against accidental deletion, perform the following operations:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon RDS console at https://console.aws.amazon.com/rds/.

03 In the navigation panel, under Amazon RDS, choose Databases.

04 Click on the name (link) of the Aurora Serverless database cluster that you want to examine. To identify the serverless database clusters, check the cluster role available in the Role column (i.e. Serverless).

05 Select the Configuration tab and check the Deletion protection attribute value. If the Deletion protection value is set to Disabled, the Deletion Protection safety feature is not enabled for the selected Amazon Aurora Serverless database cluster.

06 Repeat steps no. 4 and 5 for each Aurora Serverless database cluster available within the current AWS region.

07 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run describe-db-clusters command (OSX/Linux/UNIX) with custom query filters to list the names of all the Amazon Aurora Serverless clusters available in the selected AWS region:

aws rds describe-db-clusters
  --region us-east-1
  --output table
  --query 'DBClusters[?EngineMode==`serverless`].DBClusterIdentifier | []'

02 The command output should return a table with the requested Aurora Serverless clusters:

--------------------------------
|      DescribeDBClusters      |
+------------------------------+
|  cc-aurora-custom-cluster    |
|  cc-aurora-main-app-cluster  |
+------------------------------+

03 Execute describe-db-clusters command (OSX/Linux/UNIX) using the name of the Aurora Serverless database cluster that you want to examine as the identifier parameter and custom query filters to describe the Deletion Protection feature status for the selected cluster:

aws rds describe-db-clusters
  --region us-east-1
  --db-cluster-identifier cc-aurora-custom-cluster
  --query 'DBClusters[*].DeletionProtection'

04 The command output should return the feature status (true for enabled, false for disabled):

[
	false
]

If the describe-db-clusters command output returns false, as shown in the output example above, the Deletion Protection safety feature is not enabled for the selected Amazon Aurora Serverless database cluster.

05 Repeat steps no. 3 and 4 for each Aurora Serverless database cluster available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To enable the Deletion Protection feature for your Amazon Aurora Serverless database clusters, perform the following operations:

Using AWS CloudFormation

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Enable Deletion Protection for Aurora Serverless Clusters",
	"Parameters": {
		"ClusterIdentifier": {
			"Type": "String"
		},
		"EngineVersion": {
			"Type": "String"
		},
		"MasterUsername": {
			"Type": "String"
		},
		"MasterPassword": {
			"Type": "String",
			"NoEcho" : "true"
		},
		"MinCapacity": {
			"Type": "String"
		},
		"MaxCapacity": {
			"Type": "String"
		}
	},
	"Resources": {
	"AuroraCluster": {
		"Type": "AWS::RDS::DBCluster",
		"Properties": {
			"Engine": "aurora-postgresql",
			"DBClusterIdentifier": {
				"Ref": "ClusterIdentifier"
			},
			"EngineVersion": {
				"Ref": "EngineVersion"
			},
			"MasterUsername": {
				"Ref": "MasterUsername"
			},
			"MasterUserPassword": {
				"Ref": "MasterPassword"
			},
			"ServerlessV2ScalingConfiguration": {
				"MinCapacity": {
					"Ref": "MinCapacity"
				},
				"MaxCapacity": {
					"Ref": "MaxCapacity"
				}
			},
			"DeletionProtection": true
		}
	},
	"AuroraClusterInstance": {
		"Type": "AWS::RDS::DBInstance",
		"Properties": {
			"Engine": "aurora-postgresql",
			"DBInstanceClass": "db.serverless",
			"DBClusterIdentifier": {
				"Ref": "ClusterIdentifier"
			}
		}
	}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Enable Deletion Protection for Aurora Serverless Clusters
	Parameters:
	ClusterIdentifier:
		Type: String
	EngineVersion:
		Type: String
	MasterUsername:
		Type: String
	MasterPassword:
		Type: String
		NoEcho: 'true'
	MinCapacity:
		Type: String
	MaxCapacity:
		Type: String
	Resources:
	AuroraCluster:
		Type: AWS::RDS::DBCluster
		Properties:
		Engine: aurora-postgresql
		DBClusterIdentifier: !Ref 'ClusterIdentifier'
		EngineVersion: !Ref 'EngineVersion'
		MasterUsername: !Ref 'MasterUsername'
		MasterUserPassword: !Ref 'MasterPassword'
		ServerlessV2ScalingConfiguration:
			MinCapacity: !Ref 'MinCapacity'
			MaxCapacity: !Ref 'MaxCapacity'
		DeletionProtection: true
	AuroraClusterInstance:
		Type: AWS::RDS::DBInstance
		Properties:
		Engine: aurora-postgresql
		DBInstanceClass: db.serverless
		DBClusterIdentifier: !Ref 'ClusterIdentifier'

Using Terraform (AWS Provider)

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
	}

	required_version = ">= 0.14.9"
}

provider "aws" {
	profile = "default"
	region  = "us-east-1"
}

resource "aws_rds_cluster" "serverless-cluster" {
	cluster_identifier = "cc-aurora-cluster"
	engine             = "aurora-postgresql"
	engine_mode        = "serverless"
	engine_version     = "13.6"
	database_name      = "[database-name]"
	master_username    = "[master-username]"
	master_password    = "[master-password]"
	serverlessv2_scaling_configuration {
		max_capacity = 1.0
		min_capacity = 0.5
	}

	# Enable Deletion Protection for Aurora Serverless Clusters
	deletion_protection = true

}

resource "aws_rds_cluster_instance" "serverless-cluster-instance" {
	cluster_identifier = aws_rds_cluster.serverless-cluster.id
	instance_class     = "db.serverless"
	engine             = aws_rds_cluster.serverless-cluster.engine
	engine_version     = aws_rds_cluster.serverless-cluster.engine_version
}

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon RDS console at https://console.aws.amazon.com/rds/.

03 In the navigation panel, under Amazon RDS, choose Databases.

04 Select the Aurora Serverless database cluster that you want to reconfigure and choose Modify.

05 On the Modify DB cluster: <cluster-name> configuration page, perform the following operations:

In the Additional configuration section, under Deletion protection, select the Enable deletion protection checkbox to activate the Deletion Protection safety feature for the selected Amazon Aurora Serverless cluster.
Choose Continue and review the configuration changes that you want to apply, available in the Summary of modifications section.
In the Scheduling of modifications section, perform one of the following actions based on your workload requirements:
- Select Apply during the next scheduled maintenance window to apply the changes automatically during the next scheduled maintenance window.
- Select Apply immediately to apply the changes right away. With this option any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window configured for the selected serverless cluster. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your database application.
Choose Modify cluster to apply the configuration changes.

06 Repeat steps no. 4 and 5 for each Aurora Serverless database cluster available within the current AWS region.

07 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

01 Run modify-db-cluster command (OSX/Linux/UNIX) to enable the Deletion Protection feature for the selected Aurora Serverless database cluster by adding the --deletion-protection parameter to the command request. The following command request example makes use of --apply-immediately parameter to apply the configuration changes asynchronously and as soon as possible. Any changes available in the pending modifications queue are also applied with this request. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your Aurora database application. If you skip adding the --apply-immediately parameter to the command request, Amazon Aurora will apply your changes during the next maintenance window:

aws rds modify-db-cluster
  --region us-east-1
  --db-cluster-identifier cc-aurora-custom-cluster
  --deletion-protection
  --apply-immediately

02 The command output should return the configuration metadata for the modified Aurora cluster:

{
	"DBCluster": {
		"MasterUsername": "ccadmin",
		"ReaderEndpoint": "cc-aurora-custom-cluster.cluster-ro-abcdabcdabcd.us-east-1.rds.amazonaws.com",
		"HttpEndpointEnabled": false,
		"ReadReplicaIdentifiers": [],
		"VpcSecurityGroups": [
			{
				"Status": "active",
				"VpcSecurityGroupId": "sg-0abcd1234abcd1234"
			},
			{
				"Status": "active",
				"VpcSecurityGroupId": "sg-abcd1234"
			}
		],
		"CopyTagsToSnapshot": false,
		"HostedZoneId": "ABCDABCDABCDAB",
		"EngineMode": "serverless",
		"Status": "available",
		"MultiAZ": false,
		"LatestRestorableTime": "2021-05-12T09:00:00.162Z",
		"DomainMemberships": [],
		"PreferredBackupWindow": "04:06-04:36",
		"DBSubnetGroup": "default-vpc-abcdabcd",
		"AllocatedStorage": 30,
		"BackupRetentionPeriod": 7,
		"PreferredMaintenanceWindow": "tue:05:48-tue:06:18",
		"Engine": "aurora-mysql",
		"Endpoint": "cc-aurora-custom-cluster.cluster-abcdabcdabcd.us-east-1.rds.amazonaws.com",
		"AssociatedRoles": [],
		"EarliestRestorableTime": "2021-05-12T09:03:00.657Z",
		"CrossAccountClone": false,
		"IAMDatabaseAuthenticationEnabled": false,
		"ClusterCreateTime": "2021-05-12T09:00:00.853Z",
		"EngineVersion": "5.7.mysql_aurora.2.07.2",
		"DeletionProtection": true,
		"DBClusterIdentifier": "cc-aurora-custom-cluster",
		"DbClusterResourceId": "cluster-ABCDABCDABCDABCDABCDABCDAB",
		"DBClusterMembers": [
			{
				"IsClusterWriter": true,
				"DBClusterParameterGroupStatus": "in-sync",
				"PromotionTier": 1,
				"DBInstanceIdentifier": "cc-aurora-custom-cluster-instance-1"
			}
		],
		"DBClusterArn": "arn:aws:rds:us-east-1:123456789012:cluster:cc-aurora-custom-cluster",
		"StorageEncrypted": false,
		"DatabaseName": "",
		"DBClusterParameterGroup": "default.aurora-mysql5.7",
		"AvailabilityZones": [
			"us-east-1c",
			"us-east-1d",
			"us-east-1a"
		],
		"Port": 3306
	}
}

03 Repeat steps no. 1 and 2 for each Aurora Serverless database cluster available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.

References

AWS Command Line Interface (CLI) Documentation
rds
describe-db-clusters
modify-db-cluster

Publication date Oct 19, 2023

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS CloudFormation

Using Terraform (AWS Provider)

Using AWS Console

Using AWS CLI

References

Related RDS rules