> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Backtrack Feature Should Be Enabled

### More Info:

Backtrack feature should be enabled for your Amazon Aurora with MySQL compatibility database clusters in order to backtrack your clusters to a specific time, without using backups

### Risk Level

Low

### Address

Reliability, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of enabling the Backtrack feature for an AWS RDS instance using the AWS Management Console, follow these step-by-step instructions:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account.

        2. **Navigate to RDS Service**: Click on the "Services" dropdown menu at the top left corner of the screen and select "RDS" under the "Database" category.

        3. **Select the RDS Instance**: From the list of RDS instances, select the instance for which you want to enable the Backtrack feature by clicking on its name.

        4. **Enable Backtrack Feature**: In the RDS instance dashboard, click on the "Modify" button located at the top right corner of the screen.

        5. **Scroll down to the "Backup" Section**: In the Modify DB Instance window, scroll down to the "Backup" section.

        6. **Enable Backtrack**: Under the "Backup" section, you will find the "Enable Backtrack" option. Check the box next to "Enable Backtrack" to enable this feature.

        7. **Save Changes**: Scroll to the bottom of the page and click on the "Continue" button.

        8. **Apply Changes**: Review the changes you made, scroll down, and click on the "Modify DB Instance" button to apply the changes.

        9. **Monitor the Status**: Once the modification is complete, monitor the status of the RDS instance to ensure that the Backtrack feature has been successfully enabled.

        By following these steps, you should be able to remediate the misconfiguration of enabling the Backtrack feature for an AWS RDS instance using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling the "Backtrack" feature for an AWS RDS instance using AWS CLI, follow these steps:

        1. **Identify the RDS Instance**: First, identify the AWS RDS instance for which you want to enable the "Backtrack" feature. You can do this by listing all the RDS instances in your account using the following AWS CLI command:

           ```
           aws rds describe-db-instances
           ```

        2. **Enable Backtrack**: Once you have identified the RDS instance, you can enable the "Backtrack" feature by modifying the instance with the following AWS CLI command. Replace `your-rds-instance-identifier` with the actual identifier of your RDS instance:

           ```
           aws rds modify-db-instance --db-instance-identifier your-rds-instance-identifier --enable-backtrack
           ```

           This command will enable the "Backtrack" feature for the specified RDS instance.

        3. **Verify Backtrack Feature**: You can verify that the "Backtrack" feature has been enabled for the RDS instance by describing the instance using the following AWS CLI command:

           ```
           aws rds describe-db-instances --db-instance-identifier your-rds-instance-identifier
           ```

           Look for the `Backtrack` attribute in the output to confirm that the feature has been successfully enabled.

        By following these steps, you can remediate the misconfiguration of enabling the "Backtrack" feature for an AWS RDS instance using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance using Python, you can follow these steps:

        1. Import the necessary Python libraries:

        ```python theme={null}
        import boto3
        ```

        2. Define the AWS region and the RDS instance identifier:

        ```python theme={null}
        region = 'your_aws_region'
        instance_identifier = 'your_rds_instance_identifier'
        ```

        3. Create an AWS RDS client using Boto3:

        ```python theme={null}
        rds_client = boto3.client('rds', region_name=region)
        ```

        4. Enable the Backtrack feature for the specified RDS instance:

        ```python theme={null}
        try:
            response = rds_client.modify_db_instance(
                DBInstanceIdentifier=instance_identifier,
                EnableBacktrack=True
            )
            print("Backtrack feature has been enabled for the RDS instance.")
        except Exception as e:
            print(f"Error enabling Backtrack feature: {str(e)}")
        ```

        5. Run the Python script to enable the Backtrack feature for the specified AWS RDS instance.

        Please make sure to replace `'your_aws_region'` and `'your_rds_instance_identifier'` with your actual AWS region and RDS instance identifier before running the script.

        By following these steps and running the Python script, you should be able to remediate the misconfiguration of the Backtrack feature not being enabled for an AWS RDS instance.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_rds_cluster" "AURORA_MYSQL_CLUSTER" {
          cluster_identifier = "AURORA_MYSQL_CLUSTER_IDENTIFIER" # replace with your cluster ID
          engine             = "aurora-mysql"

          # enable backtrack with a 24-hour window (86400 seconds)
          backtrack_window  = 86400

          # optional: mimic the CLI's --apply-immediately behavior
          apply_immediately = true

          master_username = "MASTER_USERNAME" # replace
          master_password = "MASTER_PASSWORD" # replace (or use sensitive input)
          # ...other required arguments (vpc_security_group_ids, db_subnet_group_name, etc.)
        }
        ```

        Enabling `backtrack_window` does not force replacement of the cluster; it is an in‑place modification, though it can have operational impact and incurs additional storage costs for change records.

        Run `terraform plan` and verify it shows an in-place update to `aws_rds_cluster.AURORA_MYSQL_CLUSTER` with `backtrack_window` changing from `0` (or unset) to `86400` (and `apply_immediately` if you set it).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.Backtrack.html](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.Backtrack.html)