> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Backup Should Be Integrated with Amazon RDS

### More Info:

Amazon Backup should be integrated with Amazon Relational Database Service (RDS) in order to manage RDS database instance snapshots and improve the reliability of your backup strategy.

### Risk Level

Low

### Address

Reliability, Security

### Compliance Standards

CBP, AWSWAF, SOC2, NISTCSF, PCIDSS

### Remediation

How to enable amazon backup for AWS RDS

#### Using AWS Console

1. Open the AWS Management Console and navigate to the Amazon RDS service.
2. Click on the name of the RDS instance for which you want to enable Amazon Backup integration.
   (In the Cloudanix Console, navigate to "Misconfig" page and look for Affected Assets for "Amazon Backup Should Be Integrated with Amazon RDS" Policy.)
3. In the instance details page, click on the "Configuration" tab.
4. Under the "Backup" section, click on the "Enable automatic backups" checkbox if it is not already selected. Enabling automatic backups ensures that regular snapshots are taken for your RDS instance.
5. Scroll down to the "Backup retention period" setting and specify the number of days you want to retain your automated backups. Choose a value that meets your retention requirements.
6. Next, under the "Backup window" setting, define the preferred time window during which Amazon RDS can perform automated backups. This should be a time when your database has low activity to minimize any impact.
7. In the "Backup encryption" section, select the checkbox for "Enable" to enable encryption for your automated backups. You can choose to use the default AWS managed key (AWS KMS) or specify your own Customer Master Key (CMK) for encryption.
8. Once you have configured the backup settings, scroll to the bottom of the page and click on the "Modify DB instance" button to save the changes.
9. After the modifications are applied, Amazon Backup is automatically integrated with your RDS instance. It will start managing the automated backups based on the specified retention period and backup window.
10. To view and manage your RDS backups through Amazon Backup, you can navigate to the AWS Backup console. Here, you can monitor the backup status, restore your database from a backup, and set up additional backup policies if needed.

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact AWS Console steps to integrate AWS Backup with Amazon RDS and remediate the finding “Amazon Backup Should Be Integrated with Amazon RDS”.

        ***

        ## 1. Turn on AWS Backup for Amazon RDS (Service opt-in)

        1. Sign in to the **AWS Management Console**.
        2. Go to **AWS Backup**:\
           Services → search for **“Backup”** → open **AWS Backup**.
        3. In the left menu, select **Settings**.
        4. Under **Service opt-in**, find **Amazon RDS**.
        5. For the Region where your RDS runs, set **Amazon RDS** to **Enabled**.
        6. Click **Confirm** or **Save** if prompted.

        ***

        ## 2. Create (or choose) a Backup Vault

        1. In **AWS Backup**, in the left menu click **Backup vaults**.
        2. Click **Create backup vault** (skip if you already have one to use).
        3. Enter:
           * **Backup vault name** (e.g., `rds-backup-vault`).
           * Optionally choose a **KMS key** for encryption.
        4. Click **Create backup vault**.

        ***

        ## 3. Create a Backup Plan That Includes RDS

        1. In **AWS Backup**, click **Backup plans** in the left menu.
        2. Click **Create backup plan**.
        3. Choose **Build a new plan**.
        4. Fill in:
           * **Backup plan name** (e.g., `rds-daily-backup-plan`).
        5. Under **Backup rule configuration**:
           * **Rule name**: e.g., `rds-daily-backup`.
           * **Backup vault**: select the vault you created (e.g., `rds-backup-vault`).
           * **Backup frequency**: e.g., **Daily**.
           * **Backup window**: leave default or customize.
           * **Lifecycle**: set **Transition to cold storage** and **Expire** as per your policy.
        6. Click **Create plan**.

        ***

        ## 4. Assign RDS Resources to the Backup Plan

        1. After the plan is created, open it from **Backup plans**.
        2. Click **Assign resources**.
        3. Configure:
           * **Resource assignment name**: e.g., `rds-production-assignment`.
           * **IAM role**:
             * Use **Default role** (AWSBackupDefaultServiceRole) if it exists, **or**
             * Let AWS Backup create a new role when prompted.
        4. Under **Assign resources**:
           * **Resource type**: choose **Amazon RDS** (or leave as **Include all resource types** and filter by tag).
           * Choose one of:
             * **Include specific resources** → select your RDS **DB instances** or **clusters** from the list\
               OR
             * **Assign by tag** → specify tag key/value used on your RDS instances (e.g., `Backup = True`).
        5. Click **Assign resources**.

        ***

        ## 5. Verify Backups Are Working

        1. Wait until the first scheduled backup window passes (or trigger an on‑demand backup).
        2. To test on-demand:
           * Go to **Protected resources** in AWS Backup.
           * Select your RDS resource (if visible), or:
             * Go to **Backup jobs** → **Create on‑demand backup**.
             * Choose **Resource type: Amazon RDS**, then pick the specific RDS instance or cluster.
             * Choose the **Backup vault** and click **Create on‑demand backup**.
        3. Confirm a job appears under **Backup jobs** and completes with **Status: Completed**.
        4. Go to **Protected resources** and confirm your RDS instance shows recovery points.

        ***

        Once RDS is opted in to AWS Backup and your RDS instances are assigned to a backup plan with successful recovery points, the “Amazon Backup Should Be Integrated with Amazon RDS” finding will be remediated.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the core steps and CLI commands to integrate Amazon RDS with AWS Backup.

        Assumptions:

        * You have `aws` CLI configured with permissions for AWS Backup and RDS.
        * Replace placeholders like `<REGION>`, `<ACCOUNT_ID>`, `<VAULT_NAME>`, etc.

        ***

        ### 1. Opt in RDS as a protected resource in AWS Backup

        ```bash theme={null}
        aws backup update-region-settings \
          --region <REGION> \
          --resource-type-opt-in-preference '{"RDS": true}'
        ```

        Verify:

        ```bash theme={null}
        aws backup get-region-settings --region <REGION>
        ```

        Check that `"RDS": true` under `ResourceTypeOptInPreference`.

        ***

        ### 2. Create a Backup Vault (if you don’t already have one)

        ```bash theme={null}
        aws backup create-backup-vault \
          --region <REGION> \
          --backup-vault-name <VAULT_NAME> \
          --encryption-key-arn arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KMS_KEY_ID>
        ```

        If you want the default AWS Backup KMS key, you can omit `--encryption-key-arn`.

        ***

        ### 3. Create a Backup Plan

        Example: daily backups retained for 35 days.

        ```bash theme={null}
        aws backup create-backup-plan \
          --region <REGION> \
          --backup-plan '{
            "BackupPlanName": "rds-daily-backup-plan",
            "Rules": [
              {
                "RuleName": "DailyRDSBackups",
                "TargetBackupVaultName": "<VAULT_NAME>",
                "ScheduleExpression": "cron(0 5 * * ? *)",
                "StartWindowMinutes": 60,
                "CompletionWindowMinutes": 180,
                "Lifecycle": {
                  "DeleteAfterDays": 35
                }
              }
            ]
          }'
        ```

        Note the `BackupPlanId` from the response.

        ***

        ### 4. Create/Use an IAM Role for AWS Backup

        If you don’t already have the required role, create one with the AWS managed policy `AWSBackupServiceRolePolicyForBackup`.

        Trust policy (example file `trust-policy.json`):

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "Service": "backup.amazonaws.com" },
              "Action": "sts:AssumeRole"
            }
          ]
        }
        ```

        Create the role:

        ```bash theme={null}
        aws iam create-role \
          --role-name AWSBackupDefaultServiceRole \
          --assume-role-policy-document file://trust-policy.json
        ```

        Attach the managed policy:

        ```bash theme={null}
        aws iam attach-role-policy \
          --role-name AWSBackupDefaultServiceRole \
          --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
        ```

        Use the role ARN in the next step:
        `arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole`

        ***

        ### 5. Assign RDS Databases to the Backup Plan

        You can target RDS instances by ARN or by tag.

        #### Option A – Select specific RDS instances by ARN

        Get your RDS instance ARN(s):

        ```bash theme={null}
        aws rds describe-db-instances \
          --region <REGION> \
          --query 'DBInstances[*].DBInstanceArn' \
          --output text
        ```

        Create a backup selection:

        ```bash theme={null}
        aws backup create-backup-selection \
          --region <REGION> \
          --backup-plan-id <BACKUP_PLAN_ID> \
          --backup-selection '{
            "SelectionName": "rds-instance-selection",
            "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
            "Resources": [
              "arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME>"
            ]
          }'
        ```

        #### Option B – Use tags to select RDS instances

        Tag your RDS instances:

        ```bash theme={null}
        aws rds add-tags-to-resource \
          --region <REGION> \
          --resource-name arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME> \
          --tags Key=Backup,Value=Daily
        ```

        Create tag-based selection:

        ```bash theme={null}
        aws backup create-backup-selection \
          --region <REGION> \
          --backup-plan-id <BACKUP_PLAN_ID> \
          --backup-selection '{
            "SelectionName": "tagged-rds-selection",
            "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
            "ListOfTags": [
              {
                "ConditionType": "STRINGEQUALS",
                "ConditionKey": "Backup",
                "ConditionValue": "Daily"
              }
            ]
          }'
        ```

        ***

        ### 6. Verify Backups

        List backup jobs:

        ```bash theme={null}
        aws backup list-backup-jobs --region <REGION>
        ```

        Filter for `ResourceType` = `RDS` and confirm jobs complete successfully.

        This completes integrating Amazon RDS with AWS Backup using the CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concise, step‑by‑step way (with Python/boto3 code) to integrate Amazon RDS with AWS Backup. The focus is: create a backup plan, ensure required IAM role, and assign RDS resources to that plan.

        ***

        ## 1. Prerequisites

        1. An RDS instance exists.
        2. You have:
           * `boto3` installed
           * AWS credentials configured with permissions for:
             * `backup:*`
             * `rds:DescribeDBInstances`
             * `iam:CreateRole`, `iam:AttachRolePolicy` (or an existing service role for AWS Backup)

        ```bash theme={null}
        pip install boto3
        ```

        ***

        ## 2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

        AWS Backup usually uses `AWSBackupDefaultServiceRole`. If it doesn’t exist, create it.

        ```python theme={null}
        import json
        import boto3
        from botocore.exceptions import ClientError

        iam = boto3.client("iam")

        role_name = "AWSBackupDefaultServiceRole"
        assume_role_policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": "backup.amazonaws.com"},
                    "Action": "sts:AssumeRole"
                }
            ]
        }

        def ensure_backup_role():
            try:
                iam.get_role(RoleName=role_name)
                print(f"Role {role_name} already exists")
            except ClientError as e:
                if e.response["Error"]["Code"] == "NoSuchEntity":
                    print(f"Creating role {role_name}")
                    iam.create_role(
                        RoleName=role_name,
                        AssumeRolePolicyDocument=json.dumps(assume_role_policy),
                        Description="Service role for AWS Backup"
                    )
                else:
                    raise

            # Attach AWS managed policy for Backup
            iam.attach_role_policy(
                RoleName=role_name,
                PolicyArn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
            )

        ensure_backup_role()
        ```

        ***

        ## 3. Identify Your RDS Instance

        You need the DB instance ARN.

        ```python theme={null}
        import boto3

        rds = boto3.client("rds")

        db_instance_id = "my-db-instance-id"   # change to your DB instance ID

        response = rds.describe_db_instances(DBInstanceIdentifier=db_instance_id)
        db_arn = response["DBInstances"][0]["DBInstanceArn"]
        print("RDS ARN:", db_arn)
        ```

        ***

        ## 4. Create an AWS Backup Plan (if you don’t already have one)

        Example: daily backup, 35‑day retention.

        ```python theme={null}
        import boto3
        from datetime import datetime, timezone, timedelta

        backup = boto3.client("backup")

        backup_plan_name = "rds-daily-backup-plan"
        rule_name = "daily-rds-backup"

        # Example: run daily at 05:00 UTC
        schedule_cron = "cron(0 5 * * ? *)"

        backup_plan = {
            "BackupPlanName": backup_plan_name,
            "Rules": [
                {
                    "RuleName": rule_name,
                    "TargetBackupVaultName": "Default",
                    "ScheduleExpression": schedule_cron,
                    "StartWindowMinutes": 60,    # optional
                    "CompletionWindowMinutes": 180,  # optional
                    "Lifecycle": {
                        "DeleteAfterDays": 35
                    }
                }
            ]
        }

        create_resp = backup.create_backup_plan(BackupPlan=backup_plan)
        backup_plan_id = create_resp["BackupPlanId"]
        print("Backup Plan ID:", backup_plan_id)
        ```

        If you already have a plan, you can just capture its `BackupPlanId` instead of creating a new one.

        ***

        ## 5. Assign the RDS Instance to the Backup Plan

        You can assign by:

        * Direct ARN, or
        * Tags

        Here we assign by resource ARN.

        ```python theme={null}
        from uuid import uuid4

        backup = boto3.client("backup")

        selection_name = f"rds-selection-{uuid4()}"

        selection = {
            "SelectionName": selection_name,
            "IamRoleArn": f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",  # replace
            "Resources": [db_arn],
            # or use "ListOfTags" instead of "Resources" if you prefer tag-based assignments
        }

        selection_resp = backup.create_backup_selection(
            BackupPlanId=backup_plan_id,
            BackupSelection=selection
        )

        print("Backup Selection ID:", selection_resp["SelectionId"])
        ```

        ***

        ## 6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

        To verify integration, you can run an on‑demand backup:

        ```python theme={null}
        job_resp = backup.start_backup_job(
            BackupVaultName="Default",
            ResourceArn=db_arn,
            IamRoleArn=f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole"
        )

        print("Backup Job ID:", job_resp["BackupJobId"])
        ```

        ***

        ## Summary

        To remediate “Amazon Backup Should Be Integrated with Amazon RDS” via Python:

        1. Ensure `AWSBackupDefaultServiceRole` exists and has the right policy.
        2. Get your RDS instance ARN.
        3. Create (or choose) an AWS Backup plan with schedule/retention.
        4. Create a backup selection that includes the RDS ARN and uses the backup role.
        5. Optionally run an on‑demand backup to confirm.

        You can bundle these snippets into a single script and parameterize RDS instance ID, account ID, schedule, and retention as needed.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_backup_vault" "rds_vault" {
          name        = "rds-backup-vault"
          kms_key_arn = "KMS_KEY_ARN_FOR_BACKUP_VAULT" # replace with your KMS key ARN or remove if using default
        }

        resource "aws_backup_plan" "rds_plan" {
          name = "rds-backup-plan"

          rule {
            rule_name         = "rds-daily-backup"
            target_vault_name = aws_backup_vault.rds_vault.name

            schedule = "cron(0 5 * * ? *)" # daily at 05:00 UTC

            lifecycle {
              delete_after = 30 # keep backups for 30 days
            }
          }
        }

        # Example RDS instance that will be protected by AWS Backup
        resource "aws_db_instance" "rds" {
          identifier        = "RDS_INSTANCE_IDENTIFIER" # replace
          engine            = "mysql"
          instance_class    = "db.t3.micro"
          allocated_storage = 20

          username = "DB_MASTER_USERNAME" # replace
          password = "DB_MASTER_PASSWORD" # replace

          # other required arguments...
        }

        # Attach the RDS instance to the AWS Backup plan
        resource "aws_backup_selection" "rds_selection" {
          name         = "rds-selection"
          iam_role_arn = "AWS_BACKUP_ROLE_ARN" # replace with IAM role ARN that AWS Backup uses
          plan_id      = aws_backup_plan.rds_plan.id

          resources = [
            aws_db_instance.rds.arn,
          ]
        }
        ```

        This configuration creates an AWS Backup vault and plan, then integrates the RDS instance with that plan via `aws_backup_selection` (no resource replacement of the RDS instance is required).

        On `terraform plan` you should see creation of `aws_backup_vault.rds_vault`, `aws_backup_plan.rds_plan`, and `aws_backup_selection.rds_selection`, with no destructive changes to existing RDS resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* \[[https://aws.amazon.com/rds/features/backup/](https://aws.amazon.com/rds/features/backup/)]