Skip to main content

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of DocumentDB cluster not having deletion protection enabled in AWS RDS, you can follow these step-by-step instructions using the AWS Management Console:
  1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
  2. Navigate to the Amazon DocumentDB Console: Click on the “Services” dropdown menu at the top of the page, then select “DocumentDB” under the Database category.
  3. Select the DocumentDB Cluster: In the DocumentDB dashboard, locate the DocumentDB cluster that you want to enable deletion protection for, and click on its name to access its details.
  4. Enable Deletion Protection: In the cluster details page, click on the “Modify” button at the top right corner.
  5. Enable Deletion Protection Option: Scroll down to the “Deletion protection” section in the Modify cluster settings page.
  6. Enable Deletion Protection: Check the box next to “Enable deletion protection” to turn on deletion protection for the DocumentDB cluster.
  7. Save Changes: Scroll down to the bottom of the page and click on the “Modify cluster” button to save the changes.
  8. Verify Deletion Protection: Once the modification is completed, go back to the DocumentDB cluster details page and ensure that the deletion protection status is now enabled.
By following these steps, you have successfully enabled deletion protection for the DocumentDB cluster in AWS RDS using the AWS Management Console.

To remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI, follow these steps:
  1. Install and Configure AWS CLI: If you haven’t already, install the AWS CLI and configure it with the necessary credentials by running:
    Follow the prompts to input your AWS Access Key ID, Secret Access Key, default region, and default output format.
  2. Enable Deletion Protection for the DocumentDB Cluster: Run the following AWS CLI command to enable deletion protection for your DocumentDB cluster:
    Replace YOUR_CLUSTER_IDENTIFIER with the actual identifier of your DocumentDB cluster.
  3. Verify the Deletion Protection Status: To verify that deletion protection has been successfully enabled for your DocumentDB cluster, you can describe the cluster using the following command:
    Ensure that the DeletionProtection attribute in the output is set to true.
By following these steps, you can successfully remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI.
To remediate the misconfiguration of not having deletion protection enabled for an Amazon DocumentDB cluster in AWS using Python, you can use the AWS SDK for Python (boto3) to update the cluster configuration. Here are the step-by-step instructions:
  1. Install the AWS SDK for Python (boto3) if you haven’t already:
  1. Create a Python script with the following code to enable deletion protection for the DocumentDB cluster:
  1. Replace 'your-cluster-identifier' with the actual identifier of your DocumentDB cluster.
  2. Run the Python script. This will enable deletion protection for the specified DocumentDB cluster.
After following these steps, deletion protection will be enabled for your Amazon DocumentDB cluster, preventing accidental deletion of the cluster.
Changing deletion_protection to true does not force replacement of the cluster; AWS updates this setting in place.After updating, terraform plan should show a single in-place change on the existing aws_docdb_cluster.DOCDB_CLUSTER_NAME resource with deletion_protection changing from false (or null) to true.