Skip to main content

Amazon Backup Should Be Integrated with Amazon RDS

More Info:​

Amazon Backup should be integrated with Amazon Relational Database Service (RDS) in order to manage RDS database instance snapshots and improve the reliability of your backup strategy.

Risk Level​

Low

Address​

Reliability, Security

Compliance Standards​

CBP, AWSWAF, SOC2, NISTCSF, PCIDSS

Remediation​

How to enable amazon backup for AWS RDS

Using AWS Console​

  1. Open the AWS Management Console and navigate to the Amazon RDS service.
  2. Click on the name of the RDS instance for which you want to enable Amazon Backup integration. (In the Cloudanix Console, navigate to "Misconfig" page and look for Affected Assets for "Amazon Backup Should Be Integrated with Amazon RDS" Policy.)
  3. In the instance details page, click on the "Configuration" tab.
  4. Under the "Backup" section, click on the "Enable automatic backups" checkbox if it is not already selected. Enabling automatic backups ensures that regular snapshots are taken for your RDS instance.
  5. Scroll down to the "Backup retention period" setting and specify the number of days you want to retain your automated backups. Choose a value that meets your retention requirements.
  6. Next, under the "Backup window" setting, define the preferred time window during which Amazon RDS can perform automated backups. This should be a time when your database has low activity to minimize any impact.
  7. In the "Backup encryption" section, select the checkbox for "Enable" to enable encryption for your automated backups. You can choose to use the default AWS managed key (AWS KMS) or specify your own Customer Master Key (CMK) for encryption.
  8. Once you have configured the backup settings, scroll to the bottom of the page and click on the "Modify DB instance" button to save the changes.
  9. After the modifications are applied, Amazon Backup is automatically integrated with your RDS instance. It will start managing the automated backups based on the specified retention period and backup window.
  10. To view and manage your RDS backups through Amazon Backup, you can navigate to the AWS Backup console. Here, you can monitor the backup status, restore your database from a backup, and set up additional backup policies if needed.

Triage and Remediation​

Remediation​

Using Console

Below are the exact AWS Console steps to integrate AWS Backup with Amazon RDS and remediate the finding “Amazon Backup Should Be Integrated with Amazon RDS”.

1. Turn on AWS Backup for Amazon RDS (Service opt-in)​

  1. Sign in to the AWS Management Console.
  2. Go to AWS Backup:
    Services → search for “Backup” → open AWS Backup.
  3. In the left menu, select Settings.
  4. Under Service opt-in, find Amazon RDS.
  5. For the Region where your RDS runs, set Amazon RDS to Enabled.
  6. Click Confirm or Save if prompted.

2. Create (or choose) a Backup Vault​

  1. In AWS Backup, in the left menu click Backup vaults.
  2. Click Create backup vault (skip if you already have one to use).
  3. Enter:
    • Backup vault name (e.g., rds-backup-vault).
    • Optionally choose a KMS key for encryption.
  4. Click Create backup vault.

3. Create a Backup Plan That Includes RDS​

  1. In AWS Backup, click Backup plans in the left menu.
  2. Click Create backup plan.
  3. Choose Build a new plan.
  4. Fill in:
    • Backup plan name (e.g., rds-daily-backup-plan).
  5. Under Backup rule configuration:
    • Rule name: e.g., rds-daily-backup.
    • Backup vault: select the vault you created (e.g., rds-backup-vault).
    • Backup frequency: e.g., Daily.
    • Backup window: leave default or customize.
    • Lifecycle: set Transition to cold storage and Expire as per your policy.
  6. Click Create plan.

4. Assign RDS Resources to the Backup Plan​

  1. After the plan is created, open it from Backup plans.
  2. Click Assign resources.
  3. Configure:
    • Resource assignment name: e.g., rds-production-assignment.
    • IAM role:
      • Use Default role (AWSBackupDefaultServiceRole) if it exists, or
      • Let AWS Backup create a new role when prompted.
  4. Under Assign resources:
    • Resource type: choose Amazon RDS (or leave as Include all resource types and filter by tag).
    • Choose one of:
      • Include specific resources → select your RDS DB instances or clusters from the list
        OR
      • Assign by tag → specify tag key/value used on your RDS instances (e.g., Backup = True).
  5. Click Assign resources.

5. Verify Backups Are Working​

  1. Wait until the first scheduled backup window passes (or trigger an on‑demand backup).
  2. To test on-demand:
    • Go to Protected resources in AWS Backup.
    • Select your RDS resource (if visible), or:
      • Go to Backup jobs → Create on‑demand backup.
      • Choose Resource type: Amazon RDS, then pick the specific RDS instance or cluster.
      • Choose the Backup vault and click Create on‑demand backup.
  3. Confirm a job appears under Backup jobs and completes with Status: Completed.
  4. Go to Protected resources and confirm your RDS instance shows recovery points.

Once RDS is opted in to AWS Backup and your RDS instances are assigned to a backup plan with successful recovery points, the “Amazon Backup Should Be Integrated with Amazon RDS” finding will be remediated.

Using CLI

Below are the core steps and CLI commands to integrate Amazon RDS with AWS Backup.

Assumptions:

  • You have aws CLI configured with permissions for AWS Backup and RDS.
  • Replace placeholders like <REGION>, <ACCOUNT_ID>, <VAULT_NAME>, etc.

1. Opt in RDS as a protected resource in AWS Backup​

aws backup update-region-settings \
  --region <REGION> \
  --resource-type-opt-in-preference '{"RDS": true}'

Verify:

aws backup get-region-settings --region <REGION>

Check that "RDS": true under ResourceTypeOptInPreference.

2. Create a Backup Vault (if you don’t already have one)​

aws backup create-backup-vault \
  --region <REGION> \
  --backup-vault-name <VAULT_NAME> \
  --encryption-key-arn arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KMS_KEY_ID>

If you want the default AWS Backup KMS key, you can omit --encryption-key-arn.

3. Create a Backup Plan​

Example: daily backups retained for 35 days.

aws backup create-backup-plan \
  --region <REGION> \
  --backup-plan '{
    "BackupPlanName": "rds-daily-backup-plan",
    "Rules": [
      {
        "RuleName": "DailyRDSBackups",
        "TargetBackupVaultName": "<VAULT_NAME>",
        "ScheduleExpression": "cron(0 5 * * ? *)",
        "StartWindowMinutes": 60,
        "CompletionWindowMinutes": 180,
        "Lifecycle": {
          "DeleteAfterDays": 35
        }
      }
    ]
  }'

Note the BackupPlanId from the response.

4. Create/Use an IAM Role for AWS Backup​

If you don’t already have the required role, create one with the AWS managed policy AWSBackupServiceRolePolicyForBackup.

Trust policy (example file trust-policy.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "backup.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create the role:

aws iam create-role \
  --role-name AWSBackupDefaultServiceRole \
  --assume-role-policy-document file://trust-policy.json

Attach the managed policy:

aws iam attach-role-policy \
  --role-name AWSBackupDefaultServiceRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup

Use the role ARN in the next step: arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole

5. Assign RDS Databases to the Backup Plan​

You can target RDS instances by ARN or by tag.

Option A – Select specific RDS instances by ARN​

Get your RDS instance ARN(s):

aws rds describe-db-instances \
  --region <REGION> \
  --query 'DBInstances[*].DBInstanceArn' \
  --output text

Create a backup selection:

aws backup create-backup-selection \
  --region <REGION> \
  --backup-plan-id <BACKUP_PLAN_ID> \
  --backup-selection '{
    "SelectionName": "rds-instance-selection",
    "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
    "Resources": [
      "arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME>"
    ]
  }'

Option B – Use tags to select RDS instances​

Tag your RDS instances:

aws rds add-tags-to-resource \
  --region <REGION> \
  --resource-name arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME> \
  --tags Key=Backup,Value=Daily

Create tag-based selection:

aws backup create-backup-selection \
  --region <REGION> \
  --backup-plan-id <BACKUP_PLAN_ID> \
  --backup-selection '{
    "SelectionName": "tagged-rds-selection",
    "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
    "ListOfTags": [
      {
        "ConditionType": "STRINGEQUALS",
        "ConditionKey": "Backup",
        "ConditionValue": "Daily"
      }
    ]
  }'

6. Verify Backups​

List backup jobs:

aws backup list-backup-jobs --region <REGION>

Filter for ResourceType = RDS and confirm jobs complete successfully.

This completes integrating Amazon RDS with AWS Backup using the CLI.

Using Python

Below is a concise, step‑by‑step way (with Python/boto3 code) to integrate Amazon RDS with AWS Backup. The focus is: create a backup plan, ensure required IAM role, and assign RDS resources to that plan.

1. Prerequisites​

  1. An RDS instance exists.
  2. You have:
    • boto3 installed
    • AWS credentials configured with permissions for:
      • backup:*
      • rds:DescribeDBInstances
      • iam:CreateRole, iam:AttachRolePolicy (or an existing service role for AWS Backup)
pip install boto3

2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)​

AWS Backup usually uses AWSBackupDefaultServiceRole. If it doesn’t exist, create it.

import json
import boto3
from botocore.exceptions import ClientError

iam = boto3.client("iam")

role_name = "AWSBackupDefaultServiceRole"
assume_role_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"Service": "backup.amazonaws.com"},
            "Action": "sts:AssumeRole"
        }
    ]
}

def ensure_backup_role():
    try:
        iam.get_role(RoleName=role_name)
        print(f"Role {role_name} already exists")
    except ClientError as e:
        if e.response["Error"]["Code"] == "NoSuchEntity":
            print(f"Creating role {role_name}")
            iam.create_role(
                RoleName=role_name,
                AssumeRolePolicyDocument=json.dumps(assume_role_policy),
                Description="Service role for AWS Backup"
            )
        else:
            raise

    # Attach AWS managed policy for Backup
    iam.attach_role_policy(
        RoleName=role_name,
        PolicyArn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
    )

ensure_backup_role()

3. Identify Your RDS Instance​

You need the DB instance ARN.

import boto3

rds = boto3.client("rds")

db_instance_id = "my-db-instance-id"   # change to your DB instance ID

response = rds.describe_db_instances(DBInstanceIdentifier=db_instance_id)
db_arn = response["DBInstances"][0]["DBInstanceArn"]
print("RDS ARN:", db_arn)

4. Create an AWS Backup Plan (if you don’t already have one)​

Example: daily backup, 35‑day retention.

import boto3
from datetime import datetime, timezone, timedelta

backup = boto3.client("backup")

backup_plan_name = "rds-daily-backup-plan"
rule_name = "daily-rds-backup"

# Example: run daily at 05:00 UTC
schedule_cron = "cron(0 5 * * ? *)"

backup_plan = {
    "BackupPlanName": backup_plan_name,
    "Rules": [
        {
            "RuleName": rule_name,
            "TargetBackupVaultName": "Default",
            "ScheduleExpression": schedule_cron,
            "StartWindowMinutes": 60,    # optional
            "CompletionWindowMinutes": 180,  # optional
            "Lifecycle": {
                "DeleteAfterDays": 35
            }
        }
    ]
}

create_resp = backup.create_backup_plan(BackupPlan=backup_plan)
backup_plan_id = create_resp["BackupPlanId"]
print("Backup Plan ID:", backup_plan_id)

If you already have a plan, you can just capture its BackupPlanId instead of creating a new one.

5. Assign the RDS Instance to the Backup Plan​

You can assign by:

  • Direct ARN, or
  • Tags

Here we assign by resource ARN.

from uuid import uuid4

backup = boto3.client("backup")

selection_name = f"rds-selection-{uuid4()}"

selection = {
    "SelectionName": selection_name,
    "IamRoleArn": f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",  # replace
    "Resources": [db_arn],
    # or use "ListOfTags" instead of "Resources" if you prefer tag-based assignments
}

selection_resp = backup.create_backup_selection(
    BackupPlanId=backup_plan_id,
    BackupSelection=selection
)

print("Backup Selection ID:", selection_resp["SelectionId"])

6. (Optional) Start an On‑Demand Backup Job for the RDS Instance​

To verify integration, you can run an on‑demand backup:

job_resp = backup.start_backup_job(
    BackupVaultName="Default",
    ResourceArn=db_arn,
    IamRoleArn=f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole"
)

print("Backup Job ID:", job_resp["BackupJobId"])

Summary​

To remediate “Amazon Backup Should Be Integrated with Amazon RDS” via Python:

  1. Ensure AWSBackupDefaultServiceRole exists and has the right policy.
  2. Get your RDS instance ARN.
  3. Create (or choose) an AWS Backup plan with schedule/retention.
  4. Create a backup selection that includes the RDS ARN and uses the backup role.
  5. Optionally run an on‑demand backup to confirm.

You can bundle these snippets into a single script and parameterize RDS instance ID, account ID, schedule, and retention as needed.

Using Terraform
resource "aws_backup_vault" "rds_vault" {
  name        = "rds-backup-vault"
  kms_key_arn = "KMS_KEY_ARN_FOR_BACKUP_VAULT" # replace with your KMS key ARN or remove if using default
}

resource "aws_backup_plan" "rds_plan" {
  name = "rds-backup-plan"

  rule {
    rule_name         = "rds-daily-backup"
    target_vault_name = aws_backup_vault.rds_vault.name

    schedule = "cron(0 5 * * ? *)" # daily at 05:00 UTC

    lifecycle {
      delete_after = 30 # keep backups for 30 days
    }
  }
}

# Example RDS instance that will be protected by AWS Backup
resource "aws_db_instance" "rds" {
  identifier        = "RDS_INSTANCE_IDENTIFIER" # replace
  engine            = "mysql"
  instance_class    = "db.t3.micro"
  allocated_storage = 20

  username = "DB_MASTER_USERNAME" # replace
  password = "DB_MASTER_PASSWORD" # replace

  # other required arguments...
}

# Attach the RDS instance to the AWS Backup plan
resource "aws_backup_selection" "rds_selection" {
  name         = "rds-selection"
  iam_role_arn = "AWS_BACKUP_ROLE_ARN" # replace with IAM role ARN that AWS Backup uses
  plan_id      = aws_backup_plan.rds_plan.id

  resources = [
    aws_db_instance.rds.arn,
  ]
}

This configuration creates an AWS Backup vault and plan, then integrates the RDS instance with that plan via aws_backup_selection (no resource replacement of the RDS instance is required).

On terraform plan you should see creation of aws_backup_vault.rds_vault, aws_backup_plan.rds_plan, and aws_backup_selection.rds_selection, with no destructive changes to existing RDS resources.

Additional Reading:​