Backup Retention Duration Should Be Present

More Info:

As an organization you should have a backup policy with atleast minimum 7 days.

Risk Level

Medium

Address

Reliability, Operational Maturity, Security

Compliance Standards

GDPR

Remediation

How to enable RDS backup retention period to minimum 7 days

Using AWS Console

1. Open the Amazon RDS console: Go to the AWS Management Console, navigate to the RDS service, and open the RDS console.
2. Select the RDS instance: From the list of RDS instances, choose the specific instance for which you want to enable the backup retention period. (In the Cloudanix Console, navigate to "Misconfig" page and look for Affected Assets for "Backup Retention Duration Should Be Present" Policy.)
3. Modify the instance settings: On the RDS instance details page, click on the "Modify" button to change the instance settings.
4. Configure backup retention period: In the modification form, locate the "Backup" section or tab. Look for the field related to "Backup Retention Period" or similar.
5. Set the retention period: Enter the value "7" in the field to specify a backup retention period of 7 days. If the field is a dropdown, select the option corresponding to 7 days.
6. Review and apply the changes: Review the other settings on the modification form to ensure they are as desired. Click on the "Apply Changes" or similar button to save and apply the updated configuration.
7. Wait for modification completion: The modification process may take a few minutes to complete. Wait for the modification status to indicate that it is finished.

Triage and Remediation

Remediation

Remediation

Using Console

To fix “Backup Retention Duration Should Be Present” for an AWS RDS instance via the AWS Console, you need to enable/adjust Automated Backups (Backup retention period > 0).

For an existing RDS DB instance

1. Sign in to the AWS Management Console and go to RDS.
2. In the left menu, click Databases.
3. Select the DB instance you want to fix.
4. Click Modify (top right).
5. Scroll to the Additional configuration (or Backup) section:
   • Find Backup retention period.
   • Set it to a value between 1 and 35 days (e.g., 7).
   • Optionally adjust Backup window if you want a specific time.
6. Scroll down and click Continue.
7. Under Scheduling of modifications, choose:
   • Apply immediately (for instant change), or
   • During the next maintenance window (safer for production).
8. Click Modify DB instance to save.

For a new RDS DB instance

1. In RDS Console → Databases → Create database.
2. Choose engine and template as usual.
3. In Additional configuration / Backup section:
   • Set Backup retention period to ≥ 1 day.
   • Configure backup window if desired.
4. Complete other settings and click Create database.

Once the retention period is > 0, the “Backup Retention Duration Should Be Present” finding for that RDS instance should be resolved.

Using CLI

For Amazon RDS, “Backup Retention Duration Should Be Present” means the automated backup retention period must be set to a non-zero value (for Aurora: set on the cluster; for non-Aurora: on the instance).

Below are step‑by‑step AWS CLI instructions.

---

1. Identify RDS Instances with Backup Retention = 0

aws rds describe-db-instances \
  --query "DBInstances[?BackupRetentionPeriod==\`0\`].[DBInstanceIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

This lists RDS instances that have automated backups disabled.

---

2. Decide Your Desired Retention Period

Choose a value between 1 and 35 (days), according to your policy (e.g., 7 or 30 days).
In the examples below, I’ll use 7.

---

3. Remediate Non-Aurora RDS Instances

Replace my-db-instance-id and 7 with your values.

aws rds modify-db-instance \
  --db-instance-identifier my-db-instance-id \
  --backup-retention-period 7 \
  --apply-immediately

Key flags:

• --backup-retention-period 7 → enables automated backups, keeps 7 days
• --apply-immediately → apply change right away (omit if you prefer next maintenance window)

Repeat for each instance that had BackupRetentionPeriod == 0.

---

4. Remediate Aurora Clusters (if using Aurora)

For Aurora, retention is configured at the cluster level.

4.1. Find Aurora clusters with retention = 0

aws rds describe-db-clusters \
  --query "DBClusters[?BackupRetentionPeriod==\`0\`].[DBClusterIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

4.2. Set retention on each cluster

aws rds modify-db-cluster \
  --db-cluster-identifier my-aurora-cluster-id \
  --backup-retention-period 7 \
  --apply-immediately

---

5. Verify the Change

For a specific instance:

aws rds describe-db-instances \
  --db-instance-identifier my-db-instance-id \
  --query "DBInstances[0].[DBInstanceIdentifier,BackupRetentionPeriod]" \
  --output table

For a specific Aurora cluster:

aws rds describe-db-clusters \
  --db-cluster-identifier my-aurora-cluster-id \
  --query "DBClusters[0].[DBClusterIdentifier,BackupRetentionPeriod]" \
  --output table

Once BackupRetentionPeriod is greater than 0, the misconfiguration is remediated.

Using Python

For AWS RDS, “Backup Retention Duration Should Be Present” means BackupRetentionPeriod must be > 0 (automated backups enabled). Below is how to remediate it using Python (boto3).

1. Prerequisites

• Install and configure AWS CLI or set env vars so boto3 has credentials:

  pip install boto3
  aws configure

• Ensure your IAM role/user has:
  • rds:DescribeDBInstances
  • rds:ModifyDBInstance

---

2. Identify RDS instances with no backup retention

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region if needed

def list_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    bad_instances = []

    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            if retention == 0:
                bad_instances.append((name, retention))

    return bad_instances

if __name__ == "__main__":
    instances = list_instances_with_no_backups()
    if not instances:
        print("All RDS instances have backup retention > 0.")
    else:
        print("Instances with BackupRetentionPeriod=0:")
        for name, retention in instances:
            print(f" - {name} (BackupRetentionPeriod={retention})")

---

3. Remediate: set a proper backup retention period

Pick a standard (e.g., 7 days). Adjust based on your policy.

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region

TARGET_RETENTION_DAYS = 7  # set per your policy

def set_backup_retention(db_instance_id, retention_days):
    print(f"Updating {db_instance_id} to BackupRetentionPeriod={retention_days}")
    response = rds.modify_db_instance(
        DBInstanceIdentifier=db_instance_id,
        BackupRetentionPeriod=retention_days,
        ApplyImmediately=True  # or False to wait for maintenance window
    )
    return response

def fix_all_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            # Only update those with 0 (disabled)
            if retention == 0:
                set_backup_retention(name, TARGET_RETENTION_DAYS)

if __name__ == "__main__":
    fix_all_instances_with_no_backups()

---

4. Verify remediation

import boto3

rds = boto3.client("rds", region_name="us-east-1")

def verify_retention():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            print(
                db["DBInstanceIdentifier"],
                "-> BackupRetentionPeriod:",
                db.get("BackupRetentionPeriod"),
            )

if __name__ == "__main__":
    verify_retention()

---

5. Notes

• For Aurora clusters, use modify_db_cluster with BackupRetentionPeriod instead:

  rds.modify_db_cluster(
      DBClusterIdentifier="my-aurora-cluster",
      BackupRetentionPeriod=7,
      ApplyImmediately=True
  )

• BackupRetentionPeriod valid range is typically 1–35 (check the engine/region docs if needed).

Using Terraform

resource "aws_db_instance" "THIS_DB" {
  # Replace with your DB instance settings
  identifier        = "YOUR_DB_IDENTIFIER"
  engine            = "mysql"                 # or postgres, etc.
  instance_class    = "db.t3.medium"
  allocated_storage = 20
  username          = "YOUR_MASTER_USERNAME"
  password          = "YOUR_MASTER_PASSWORD"
  db_subnet_group_name = aws_db_subnet_group.this.name

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

If you are using Aurora or another RDS cluster, configure it on the cluster resource:

resource "aws_rds_cluster" "THIS_CLUSTER" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"
  engine             = "aurora-mysql"   # or aurora-postgresql, etc.
  master_username    = "YOUR_MASTER_USERNAME"
  master_password    = "YOUR_MASTER_PASSWORD"

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

Changing backup_retention_period is an in‑place modification and does not force replacement of the DB instance or cluster.

After you add or change this argument, terraform plan should show an in-place update with a change like:

• backup_retention_period: "0" => "7"

Additional Reading:

• [https://aws.amazon.com/rds/faqs/#:~:text=Amazon%20RDS%20retains%20backups%20of,to%20the%20Latest%20Restorable%20Time.]