> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rds amazon backup integrated remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact AWS Console steps to integrate AWS Backup with Amazon RDS and remediate the finding “Amazon Backup Should Be Integrated with Amazon RDS”.

        ***

        ## 1. Turn on AWS Backup for Amazon RDS (Service opt-in)

        1. Sign in to the **AWS Management Console**.
        2. Go to **AWS Backup**:\
           Services → search for **“Backup”** → open **AWS Backup**.
        3. In the left menu, select **Settings**.
        4. Under **Service opt-in**, find **Amazon RDS**.
        5. For the Region where your RDS runs, set **Amazon RDS** to **Enabled**.
        6. Click **Confirm** or **Save** if prompted.

        ***

        ## 2. Create (or choose) a Backup Vault

        1. In **AWS Backup**, in the left menu click **Backup vaults**.
        2. Click **Create backup vault** (skip if you already have one to use).
        3. Enter:
           * **Backup vault name** (e.g., `rds-backup-vault`).
           * Optionally choose a **KMS key** for encryption.
        4. Click **Create backup vault**.

        ***

        ## 3. Create a Backup Plan That Includes RDS

        1. In **AWS Backup**, click **Backup plans** in the left menu.
        2. Click **Create backup plan**.
        3. Choose **Build a new plan**.
        4. Fill in:
           * **Backup plan name** (e.g., `rds-daily-backup-plan`).
        5. Under **Backup rule configuration**:
           * **Rule name**: e.g., `rds-daily-backup`.
           * **Backup vault**: select the vault you created (e.g., `rds-backup-vault`).
           * **Backup frequency**: e.g., **Daily**.
           * **Backup window**: leave default or customize.
           * **Lifecycle**: set **Transition to cold storage** and **Expire** as per your policy.
        6. Click **Create plan**.

        ***

        ## 4. Assign RDS Resources to the Backup Plan

        1. After the plan is created, open it from **Backup plans**.
        2. Click **Assign resources**.
        3. Configure:
           * **Resource assignment name**: e.g., `rds-production-assignment`.
           * **IAM role**:
             * Use **Default role** (AWSBackupDefaultServiceRole) if it exists, **or**
             * Let AWS Backup create a new role when prompted.
        4. Under **Assign resources**:
           * **Resource type**: choose **Amazon RDS** (or leave as **Include all resource types** and filter by tag).
           * Choose one of:
             * **Include specific resources** → select your RDS **DB instances** or **clusters** from the list\
               OR
             * **Assign by tag** → specify tag key/value used on your RDS instances (e.g., `Backup = True`).
        5. Click **Assign resources**.

        ***

        ## 5. Verify Backups Are Working

        1. Wait until the first scheduled backup window passes (or trigger an on‑demand backup).
        2. To test on-demand:
           * Go to **Protected resources** in AWS Backup.
           * Select your RDS resource (if visible), or:
             * Go to **Backup jobs** → **Create on‑demand backup**.
             * Choose **Resource type: Amazon RDS**, then pick the specific RDS instance or cluster.
             * Choose the **Backup vault** and click **Create on‑demand backup**.
        3. Confirm a job appears under **Backup jobs** and completes with **Status: Completed**.
        4. Go to **Protected resources** and confirm your RDS instance shows recovery points.

        ***

        Once RDS is opted in to AWS Backup and your RDS instances are assigned to a backup plan with successful recovery points, the “Amazon Backup Should Be Integrated with Amazon RDS” finding will be remediated.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the core steps and CLI commands to integrate Amazon RDS with AWS Backup.

        Assumptions:

        * You have `aws` CLI configured with permissions for AWS Backup and RDS.
        * Replace placeholders like `<REGION>`, `<ACCOUNT_ID>`, `<VAULT_NAME>`, etc.

        ***

        ### 1. Opt in RDS as a protected resource in AWS Backup

        ```bash theme={null}
        aws backup update-region-settings \
          --region <REGION> \
          --resource-type-opt-in-preference '{"RDS": true}'
        ```

        Verify:

        ```bash theme={null}
        aws backup get-region-settings --region <REGION>
        ```

        Check that `"RDS": true` under `ResourceTypeOptInPreference`.

        ***

        ### 2. Create a Backup Vault (if you don’t already have one)

        ```bash theme={null}
        aws backup create-backup-vault \
          --region <REGION> \
          --backup-vault-name <VAULT_NAME> \
          --encryption-key-arn arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KMS_KEY_ID>
        ```

        If you want the default AWS Backup KMS key, you can omit `--encryption-key-arn`.

        ***

        ### 3. Create a Backup Plan

        Example: daily backups retained for 35 days.

        ```bash theme={null}
        aws backup create-backup-plan \
          --region <REGION> \
          --backup-plan '{
            "BackupPlanName": "rds-daily-backup-plan",
            "Rules": [
              {
                "RuleName": "DailyRDSBackups",
                "TargetBackupVaultName": "<VAULT_NAME>",
                "ScheduleExpression": "cron(0 5 * * ? *)",
                "StartWindowMinutes": 60,
                "CompletionWindowMinutes": 180,
                "Lifecycle": {
                  "DeleteAfterDays": 35
                }
              }
            ]
          }'
        ```

        Note the `BackupPlanId` from the response.

        ***

        ### 4. Create/Use an IAM Role for AWS Backup

        If you don’t already have the required role, create one with the AWS managed policy `AWSBackupServiceRolePolicyForBackup`.

        Trust policy (example file `trust-policy.json`):

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "Service": "backup.amazonaws.com" },
              "Action": "sts:AssumeRole"
            }
          ]
        }
        ```

        Create the role:

        ```bash theme={null}
        aws iam create-role \
          --role-name AWSBackupDefaultServiceRole \
          --assume-role-policy-document file://trust-policy.json
        ```

        Attach the managed policy:

        ```bash theme={null}
        aws iam attach-role-policy \
          --role-name AWSBackupDefaultServiceRole \
          --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
        ```

        Use the role ARN in the next step:
        `arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole`

        ***

        ### 5. Assign RDS Databases to the Backup Plan

        You can target RDS instances by ARN or by tag.

        #### Option A – Select specific RDS instances by ARN

        Get your RDS instance ARN(s):

        ```bash theme={null}
        aws rds describe-db-instances \
          --region <REGION> \
          --query 'DBInstances[*].DBInstanceArn' \
          --output text
        ```

        Create a backup selection:

        ```bash theme={null}
        aws backup create-backup-selection \
          --region <REGION> \
          --backup-plan-id <BACKUP_PLAN_ID> \
          --backup-selection '{
            "SelectionName": "rds-instance-selection",
            "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
            "Resources": [
              "arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME>"
            ]
          }'
        ```

        #### Option B – Use tags to select RDS instances

        Tag your RDS instances:

        ```bash theme={null}
        aws rds add-tags-to-resource \
          --region <REGION> \
          --resource-name arn:aws:rds:<REGION>:<ACCOUNT_ID>:db:<DB_INSTANCE_NAME> \
          --tags Key=Backup,Value=Daily
        ```

        Create tag-based selection:

        ```bash theme={null}
        aws backup create-backup-selection \
          --region <REGION> \
          --backup-plan-id <BACKUP_PLAN_ID> \
          --backup-selection '{
            "SelectionName": "tagged-rds-selection",
            "IamRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",
            "ListOfTags": [
              {
                "ConditionType": "STRINGEQUALS",
                "ConditionKey": "Backup",
                "ConditionValue": "Daily"
              }
            ]
          }'
        ```

        ***

        ### 6. Verify Backups

        List backup jobs:

        ```bash theme={null}
        aws backup list-backup-jobs --region <REGION>
        ```

        Filter for `ResourceType` = `RDS` and confirm jobs complete successfully.

        This completes integrating Amazon RDS with AWS Backup using the CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concise, step‑by‑step way (with Python/boto3 code) to integrate Amazon RDS with AWS Backup. The focus is: create a backup plan, ensure required IAM role, and assign RDS resources to that plan.

        ***

        ## 1. Prerequisites

        1. An RDS instance exists.
        2. You have:
           * `boto3` installed
           * AWS credentials configured with permissions for:
             * `backup:*`
             * `rds:DescribeDBInstances`
             * `iam:CreateRole`, `iam:AttachRolePolicy` (or an existing service role for AWS Backup)

        ```bash theme={null}
        pip install boto3
        ```

        ***

        ## 2. Create/Verify the AWS Backup IAM Role (AWSBackupDefaultServiceRole)

        AWS Backup usually uses `AWSBackupDefaultServiceRole`. If it doesn’t exist, create it.

        ```python theme={null}
        import json
        import boto3
        from botocore.exceptions import ClientError

        iam = boto3.client("iam")

        role_name = "AWSBackupDefaultServiceRole"
        assume_role_policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": "backup.amazonaws.com"},
                    "Action": "sts:AssumeRole"
                }
            ]
        }

        def ensure_backup_role():
            try:
                iam.get_role(RoleName=role_name)
                print(f"Role {role_name} already exists")
            except ClientError as e:
                if e.response["Error"]["Code"] == "NoSuchEntity":
                    print(f"Creating role {role_name}")
                    iam.create_role(
                        RoleName=role_name,
                        AssumeRolePolicyDocument=json.dumps(assume_role_policy),
                        Description="Service role for AWS Backup"
                    )
                else:
                    raise

            # Attach AWS managed policy for Backup
            iam.attach_role_policy(
                RoleName=role_name,
                PolicyArn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
            )

        ensure_backup_role()
        ```

        ***

        ## 3. Identify Your RDS Instance

        You need the DB instance ARN.

        ```python theme={null}
        import boto3

        rds = boto3.client("rds")

        db_instance_id = "my-db-instance-id"   # change to your DB instance ID

        response = rds.describe_db_instances(DBInstanceIdentifier=db_instance_id)
        db_arn = response["DBInstances"][0]["DBInstanceArn"]
        print("RDS ARN:", db_arn)
        ```

        ***

        ## 4. Create an AWS Backup Plan (if you don’t already have one)

        Example: daily backup, 35‑day retention.

        ```python theme={null}
        import boto3
        from datetime import datetime, timezone, timedelta

        backup = boto3.client("backup")

        backup_plan_name = "rds-daily-backup-plan"
        rule_name = "daily-rds-backup"

        # Example: run daily at 05:00 UTC
        schedule_cron = "cron(0 5 * * ? *)"

        backup_plan = {
            "BackupPlanName": backup_plan_name,
            "Rules": [
                {
                    "RuleName": rule_name,
                    "TargetBackupVaultName": "Default",
                    "ScheduleExpression": schedule_cron,
                    "StartWindowMinutes": 60,    # optional
                    "CompletionWindowMinutes": 180,  # optional
                    "Lifecycle": {
                        "DeleteAfterDays": 35
                    }
                }
            ]
        }

        create_resp = backup.create_backup_plan(BackupPlan=backup_plan)
        backup_plan_id = create_resp["BackupPlanId"]
        print("Backup Plan ID:", backup_plan_id)
        ```

        If you already have a plan, you can just capture its `BackupPlanId` instead of creating a new one.

        ***

        ## 5. Assign the RDS Instance to the Backup Plan

        You can assign by:

        * Direct ARN, or
        * Tags

        Here we assign by resource ARN.

        ```python theme={null}
        from uuid import uuid4

        backup = boto3.client("backup")

        selection_name = f"rds-selection-{uuid4()}"

        selection = {
            "SelectionName": selection_name,
            "IamRoleArn": f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole",  # replace
            "Resources": [db_arn],
            # or use "ListOfTags" instead of "Resources" if you prefer tag-based assignments
        }

        selection_resp = backup.create_backup_selection(
            BackupPlanId=backup_plan_id,
            BackupSelection=selection
        )

        print("Backup Selection ID:", selection_resp["SelectionId"])
        ```

        ***

        ## 6. (Optional) Start an On‑Demand Backup Job for the RDS Instance

        To verify integration, you can run an on‑demand backup:

        ```python theme={null}
        job_resp = backup.start_backup_job(
            BackupVaultName="Default",
            ResourceArn=db_arn,
            IamRoleArn=f"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/AWSBackupDefaultServiceRole"
        )

        print("Backup Job ID:", job_resp["BackupJobId"])
        ```

        ***

        ## Summary

        To remediate “Amazon Backup Should Be Integrated with Amazon RDS” via Python:

        1. Ensure `AWSBackupDefaultServiceRole` exists and has the right policy.
        2. Get your RDS instance ARN.
        3. Create (or choose) an AWS Backup plan with schedule/retention.
        4. Create a backup selection that includes the RDS ARN and uses the backup role.
        5. Optionally run an on‑demand backup to confirm.

        You can bundle these snippets into a single script and parameterize RDS instance ID, account ID, schedule, and retention as needed.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_backup_vault" "rds_vault" {
          name        = "rds-backup-vault"
          kms_key_arn = "KMS_KEY_ARN_FOR_BACKUP_VAULT" # replace with your KMS key ARN or remove if using default
        }

        resource "aws_backup_plan" "rds_plan" {
          name = "rds-backup-plan"

          rule {
            rule_name         = "rds-daily-backup"
            target_vault_name = aws_backup_vault.rds_vault.name

            schedule = "cron(0 5 * * ? *)" # daily at 05:00 UTC

            lifecycle {
              delete_after = 30 # keep backups for 30 days
            }
          }
        }

        # Example RDS instance that will be protected by AWS Backup
        resource "aws_db_instance" "rds" {
          identifier        = "RDS_INSTANCE_IDENTIFIER" # replace
          engine            = "mysql"
          instance_class    = "db.t3.micro"
          allocated_storage = 20

          username = "DB_MASTER_USERNAME" # replace
          password = "DB_MASTER_PASSWORD" # replace

          # other required arguments...
        }

        # Attach the RDS instance to the AWS Backup plan
        resource "aws_backup_selection" "rds_selection" {
          name         = "rds-selection"
          iam_role_arn = "AWS_BACKUP_ROLE_ARN" # replace with IAM role ARN that AWS Backup uses
          plan_id      = aws_backup_plan.rds_plan.id

          resources = [
            aws_db_instance.rds.arn,
          ]
        }
        ```

        This configuration creates an AWS Backup vault and plan, then integrates the RDS instance with that plan via `aws_backup_selection` (no resource replacement of the RDS instance is required).

        On `terraform plan` you should see creation of `aws_backup_vault.rds_vault`, `aws_backup_plan.rds_plan`, and `aws_backup_selection.rds_selection`, with no destructive changes to existing RDS resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>