> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# DocumentDB Cluster Should Have Deletion Protection Enabled

### More Info:

Checks if an Amazon DocumentDB (with MongoDB compatibility) cluster has deletion protection enabled. The rule is NON\_COMPLIANT if an Amazon DocumentDB cluster has the deletionProtection field set to false.

### Risk Level

High

### Address

Configuration

### Compliance Standards

NIST,CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of DocumentDB cluster not having deletion protection enabled in AWS RDS, you can follow these step-by-step instructions using the AWS Management Console:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account.

        2. **Navigate to the Amazon DocumentDB Console**: Click on the "Services" dropdown menu at the top of the page, then select "DocumentDB" under the Database category.

        3. **Select the DocumentDB Cluster**: In the DocumentDB dashboard, locate the DocumentDB cluster that you want to enable deletion protection for, and click on its name to access its details.

        4. **Enable Deletion Protection**: In the cluster details page, click on the "Modify" button at the top right corner.

        5. **Enable Deletion Protection Option**: Scroll down to the "Deletion protection" section in the Modify cluster settings page.

        6. **Enable Deletion Protection**: Check the box next to "Enable deletion protection" to turn on deletion protection for the DocumentDB cluster.

        7. **Save Changes**: Scroll down to the bottom of the page and click on the "Modify cluster" button to save the changes.

        8. **Verify Deletion Protection**: Once the modification is completed, go back to the DocumentDB cluster details page and ensure that the deletion protection status is now enabled.

        By following these steps, you have successfully enabled deletion protection for the DocumentDB cluster in AWS RDS using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI, follow these steps:

        1. **Install and Configure AWS CLI:**
           If you haven't already, install the AWS CLI and configure it with the necessary credentials by running:
           ```
           aws configure
           ```
           Follow the prompts to input your AWS Access Key ID, Secret Access Key, default region, and default output format.

        2. **Enable Deletion Protection for the DocumentDB Cluster:**
           Run the following AWS CLI command to enable deletion protection for your DocumentDB cluster:
           ```
           aws docdb modify-db-cluster --db-cluster-identifier YOUR_CLUSTER_IDENTIFIER --deletion-protection
           ```
           Replace `YOUR_CLUSTER_IDENTIFIER` with the actual identifier of your DocumentDB cluster.

        3. **Verify the Deletion Protection Status:**
           To verify that deletion protection has been successfully enabled for your DocumentDB cluster, you can describe the cluster using the following command:
           ```
           aws docdb describe-db-clusters --db-cluster-identifier YOUR_CLUSTER_IDENTIFIER
           ```
           Ensure that the `DeletionProtection` attribute in the output is set to `true`.

        By following these steps, you can successfully remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of not having deletion protection enabled for an Amazon DocumentDB cluster in AWS using Python, you can use the AWS SDK for Python (boto3) to update the cluster configuration. Here are the step-by-step instructions:

        1. Install the AWS SDK for Python (boto3) if you haven't already:

        ```bash theme={null}
        pip install boto3
        ```

        2. Create a Python script with the following code to enable deletion protection for the DocumentDB cluster:

        ```python theme={null}
        import boto3

        # Initialize the DocumentDB client
        client = boto3.client('docdb')

        # Specify the DocumentDB cluster identifier
        cluster_identifier = 'your-cluster-identifier'

        # Enable deletion protection for the DocumentDB cluster
        response = client.modify_db_cluster(
            DBClusterIdentifier=cluster_identifier,
            DeletionProtection=True
        )

        # Print the response
        print(response)
        ```

        3. Replace `'your-cluster-identifier'` with the actual identifier of your DocumentDB cluster.

        4. Run the Python script. This will enable deletion protection for the specified DocumentDB cluster.

        After following these steps, deletion protection will be enabled for your Amazon DocumentDB cluster, preventing accidental deletion of the cluster.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>