Ensure that all your Amazon RDS database instances have the Deletion Protection feature enabled in order to protect them from being accidentally deleted.
This rule can help you with the following compliance standards:
- NIST4
For further details on compliance standards supported by Conformity, see here.
This rule resolution is part of the Conformity Security & Compliance tool for AWS.
With Deletion Protection safety feature enabled, you have the guarantee that your Amazon RDS database instances can't be accidentally deleted and make sure that your data remains safe. Deletion protection prevents any existing or new database instances from being deleted by users via the AWS Management Console, the AWS CLI, or the AWS API, unless the feature is explicitly disabled.
Note: Deletion protection for Amazon RDS instances is supported by all database engines, except Amazon Aurora where the Deletion Protection feature is implemented at the cluster level, not instance level.
Audit
To determine if your Amazon RDS database instances are protected against accidental deletion, perform the following operations:
Remediation / Resolution
To enable the Deletion Protection feature for your existing Amazon RDS database instances, perform the following operations:
References
- AWS Documentation
- Amazon RDS FAQs
- Amazon RDS Now Provides Database Deletion Protection
- Amazon RDS Now Provides Database Deletion Protection
- Modifying an Amazon RDS DB instance
- AWS Command Line Interface (CLI) Documentation
- rds
- describe-db-instances
- modify-db-instance
- CloudFormation Documentation
- Amazon Relational Database Service resource type reference
- Terraform Documentation
- AWS Provider
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Instance Deletion Protection
Risk Level: Medium