> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Backup plan min retention check remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using the AWS console, follow these steps: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and login using your credentials. 2. **Navigate to AWS Backup Service**: In the AWS Management Console, search for "Backup" in the services search bar and click on "Backup" under the "Storage" category. 3. **Select Backup Plans**: In the AWS Backup console, click on "Backup plans" in the left-hand navigation pane. 4. **Edit Backup Plan**: Find the backup plan that needs to have a retention period set and click on the plan name to select it. 5. **Add Retention Period**: In the details of the backup plan, locate the section where you can set the retention period. Click on the "Edit" button next to the retention settings. 6. **Set Retention Period**: Enter the desired retention period in days for the backups to be retained. This can vary depending on your organization's retention policies. 7. **Save Changes**: After setting the retention period, click on the "Save" or "Update" button to save the changes to the backup plan. 8. **Verify Configuration**: Double-check the backup plan details to ensure that the retention period has been successfully set. By following these steps, you have successfully remediated the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using the AWS console. # To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using AWS CLI, follow these steps: 1. **List Backup Plans**: First, list all the existing backup plans to identify the one that needs to be updated. You can use the following AWS CLI command: ```bash theme={null} aws backup list-backup-plans ``` 2. **Update Backup Plan**: Once you have identified the backup plan that needs to be updated, you can use the following AWS CLI command to update the backup plan with a retention period: ```bash theme={null} aws backup update-backup-plan --backup-plan-id --lifecycle ResourceType=EC2,DeleteAfterDays= ``` Replace `` with the ID of the backup plan that needs to be updated and `` with the number of days you want to retain the backups. 3. **Verify**: Finally, verify that the retention period has been set successfully by listing the details of the updated backup plan using the following AWS CLI command: ```bash theme={null} aws backup get-backup-plan --backup-plan-id ``` This command will display the details of the backup plan, including the retention period for EC2 resources. By following these steps, you can remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using AWS CLI. To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using Python, you can follow these steps: 1. Install the AWS SDK for Python (Boto3) if you haven't already. You can install it using pip: ``` pip install boto3 ``` 2. Write a Python script to update the backup plan with the desired retention period. Here is an example script to set a retention period of 30 days for a backup plan in AWS EC2: ```python theme={null} import boto3 # Initialize the EC2 client client = boto3.client('backup') # Specify the Backup Plan Id for which you want to update the retention period backup_plan_id = 'your_backup_plan_id_here' # Specify the desired retention period in days retention_period = 30 # Update the backup plan with the new retention period response = client.update_backup_plan( BackupPlanId=backup_plan_id, BackupPlan={ 'BackupPlanName': 'YourBackupPlanName', 'Rules': [ { 'RuleName': 'DefaultBackupRule', 'TargetBackupVaultName': 'Default', 'ScheduleExpression': 'cron(0 0 * * ? *)', 'StartWindowMinutes': 60, 'CompletionWindowMinutes': 60, 'Lifecycle': { 'DeleteAfterDays': retention_period } } ] } ) # Print the response print(response) ``` 3. Replace `'your_backup_plan_id_here'` with the actual Backup Plan Id that you want to update. 4. Replace `'YourBackupPlanName'` with the name of your backup plan. 5. Run the Python script to update the backup plan with the specified retention period. After running this script, the backup plan in AWS EC2 will be updated with the specified retention period, ensuring that backups are retained for the desired duration. ```hcl theme={null} resource "aws_backup_plan" "EC2_BACKUP_PLAN" { name = "EC2_BACKUP_PLAN_NAME" # replace with your backup plan name rule { rule_name = "EC2_DAILY_BACKUP_RULE" # replace with your rule name target_vault_name = aws_backup_vault.EC2_BACKUP_VAULT.name schedule = "cron(0 5 * * ? *)" # replace with your required frequency lifecycle { delete_after = DESIRED_RETENTION_DAYS # replace with an integer, e.g. 35 } } } resource "aws_backup_vault" "EC2_BACKUP_VAULT" { name = "EC2_BACKUP_VAULT_NAME" # replace with your backup vault name } ``` This mirrors the CLI fix by adding/modifying the `lifecycle` block in the backup rule and setting `delete_after` (e.g., 35) to enforce the retention period in days; it updates the existing plan in place and does not force replacement of the backup vault or plan, only a configuration change to the rule. To verify, `terraform plan` should show an in-place update to `aws_backup_plan.EC2_BACKUP_PLAN` with a change adding or modifying `lifecycle.delete_after` to `DESIRED_RETENTION_DAYS`.