Aurora DB Clusters Should Be Protected By Backup Plan

More Info:

Checks if Amazon Aurora DB clusters are protected by a backup plan. The rule is NON_COMPLIANT if the Amazon Relational Database Service (Amazon RDS) Database Cluster is not protected by a backup plan.

Risk Level

High

Address

Configuration

Compliance Standards

CBP,SEBI,RBI_MD_ITF,RBI_UCB

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of Aurora DB clusters not being protected by a backup plan in AWS RDS using AWS CLI, follow these steps:

Create a Backup Plan:
- Run the following AWS CLI command to create a backup plan for your Aurora DB cluster:
  aws backup create-backup-plan --backup-plan '{"BackupPlanName": "YourBackupPlanName", "Rules": [{"RuleName": "Rule1", "TargetBackupVaultName": "Default", "ScheduleExpression": "cron(0 0 * * ? *)", "StartWindowMinutes": 60}]}'
- Replace "YourBackupPlanName" with a suitable name for your backup plan.
- This command creates a backup plan with a rule named “Rule1” that schedules daily backups at midnight UTC.
Associate the Backup Plan with the Aurora DB Cluster:
- Run the following AWS CLI command to associate the backup plan with your Aurora DB cluster:
  aws backup create-backup-selection --backup-plan-id <BackupPlanId> --backup-selection '{"SelectionName": "YourSelectionName", "IamRoleArn": "YourIamRoleArn", "Resources": ["arn:aws:rds:region:account-id:cluster:cluster-name"]}'
- Replace <BackupPlanId> with the ID of the backup plan you created in step 1.
- Replace "YourSelectionName" with a suitable name for your backup selection.
- Replace "YourIamRoleArn" with the IAM role ARN that has permissions to perform backups.
- Replace "region", "account-id", and "cluster-name" with your AWS region, account ID, and Aurora DB cluster name, respectively.
Verify the Backup Plan Configuration:
- Run the following AWS CLI command to verify that the backup plan is associated with the Aurora DB cluster:
  aws backup list-backup-selections --backup-plan-id <BackupPlanId>
- This command will list the backup selections associated with the specified backup plan.

By following these steps, you can remediate the misconfiguration of Aurora DB clusters not being protected by a backup plan in AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of Aurora DB clusters not being protected by a backup plan in AWS RDS using Python, you can follow these steps:

Install Boto3: Boto3 is the AWS SDK for Python, which allows you to interact with AWS services. You can install it using pip:
```
pip install boto3
```
Create a Python script to enable backups for your Aurora DB cluster. Here is an example script that you can use:

import boto3

# Define the AWS region and your Aurora DB cluster identifier
region = 'your_aws_region'
cluster_identifier = 'your_cluster_identifier'

# Create an RDS client
rds = boto3.client('rds', region_name=region)

# Enable backups for the Aurora DB cluster
response = rds.modify_db_cluster(
    DBClusterIdentifier=cluster_identifier,
    BackupRetentionPeriod=7,  # Set the number of days to retain backups
    BackupWindow='03:00-04:00',  # Set the preferred backup window
    ApplyImmediately=True
)

print("Backup plan enabled for Aurora DB cluster:", cluster_identifier)

Replace placeholders: Replace your_aws_region with the AWS region where your Aurora DB cluster is located, and your_cluster_identifier with the actual identifier of your Aurora DB cluster.
Run the script: Save the script to a file (e.g., enable_backup_plan.py) and run it using Python. Make sure you have the necessary permissions in your AWS IAM role to modify the Aurora DB cluster.

python enable_backup_plan.py

By following these steps, you can remediate the misconfiguration of Aurora DB clusters not being protected by a backup plan in AWS RDS using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Aurora DB Clusters Should Be Protected By Backup Plan

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation