Skip to main content

RDS Backup Retention Days Remediation

Triage and Remediation​

Remediation​

Using Console

To fix “Backup Retention Duration Should Be Present” for an AWS RDS instance via the AWS Console, you need to enable/adjust Automated Backups (Backup retention period > 0).

For an existing RDS DB instance​

  1. Sign in to the AWS Management Console and go to RDS.
  2. In the left menu, click Databases.
  3. Select the DB instance you want to fix.
  4. Click Modify (top right).
  5. Scroll to the Additional configuration (or Backup) section:
    • Find Backup retention period.
    • Set it to a value between 1 and 35 days (e.g., 7).
    • Optionally adjust Backup window if you want a specific time.
  6. Scroll down and click Continue.
  7. Under Scheduling of modifications, choose:
    • Apply immediately (for instant change), or
    • During the next maintenance window (safer for production).
  8. Click Modify DB instance to save.

For a new RDS DB instance​

  1. In RDS Console → Databases → Create database.
  2. Choose engine and template as usual.
  3. In Additional configuration / Backup section:
    • Set Backup retention period to ≥ 1 day.
    • Configure backup window if desired.
  4. Complete other settings and click Create database.

Once the retention period is > 0, the “Backup Retention Duration Should Be Present” finding for that RDS instance should be resolved.

Using CLI

For Amazon RDS, “Backup Retention Duration Should Be Present” means the automated backup retention period must be set to a non-zero value (for Aurora: set on the cluster; for non-Aurora: on the instance).

Below are step‑by‑step AWS CLI instructions.

1. Identify RDS Instances with Backup Retention = 0​

aws rds describe-db-instances \
  --query "DBInstances[?BackupRetentionPeriod==\`0\`].[DBInstanceIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

This lists RDS instances that have automated backups disabled.

2. Decide Your Desired Retention Period​

Choose a value between 1 and 35 (days), according to your policy (e.g., 7 or 30 days).
In the examples below, I’ll use 7.

3. Remediate Non-Aurora RDS Instances​

Replace my-db-instance-id and 7 with your values.

aws rds modify-db-instance \
  --db-instance-identifier my-db-instance-id \
  --backup-retention-period 7 \
  --apply-immediately

Key flags:

  • --backup-retention-period 7 → enables automated backups, keeps 7 days
  • --apply-immediately → apply change right away (omit if you prefer next maintenance window)

Repeat for each instance that had BackupRetentionPeriod == 0.

4. Remediate Aurora Clusters (if using Aurora)​

For Aurora, retention is configured at the cluster level.

4.1. Find Aurora clusters with retention = 0​

aws rds describe-db-clusters \
  --query "DBClusters[?BackupRetentionPeriod==\`0\`].[DBClusterIdentifier,Engine,BackupRetentionPeriod]" \
  --output table

4.2. Set retention on each cluster​

aws rds modify-db-cluster \
  --db-cluster-identifier my-aurora-cluster-id \
  --backup-retention-period 7 \
  --apply-immediately

5. Verify the Change​

For a specific instance:

aws rds describe-db-instances \
  --db-instance-identifier my-db-instance-id \
  --query "DBInstances[0].[DBInstanceIdentifier,BackupRetentionPeriod]" \
  --output table

For a specific Aurora cluster:

aws rds describe-db-clusters \
  --db-cluster-identifier my-aurora-cluster-id \
  --query "DBClusters[0].[DBClusterIdentifier,BackupRetentionPeriod]" \
  --output table

Once BackupRetentionPeriod is greater than 0, the misconfiguration is remediated.

Using Python

For AWS RDS, “Backup Retention Duration Should Be Present” means BackupRetentionPeriod must be > 0 (automated backups enabled). Below is how to remediate it using Python (boto3).

1. Prerequisites​

  • Install and configure AWS CLI or set env vars so boto3 has credentials: 
    pip install boto3
    aws configure
  • Ensure your IAM role/user has:
    • rds:DescribeDBInstances
    • rds:ModifyDBInstance

2. Identify RDS instances with no backup retention​

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region if needed

def list_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    bad_instances = []

    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            if retention == 0:
                bad_instances.append((name, retention))

    return bad_instances

if __name__ == "__main__":
    instances = list_instances_with_no_backups()
    if not instances:
        print("All RDS instances have backup retention > 0.")
    else:
        print("Instances with BackupRetentionPeriod=0:")
        for name, retention in instances:
            print(f" - {name} (BackupRetentionPeriod={retention})")

3. Remediate: set a proper backup retention period​

Pick a standard (e.g., 7 days). Adjust based on your policy.

import boto3

rds = boto3.client("rds", region_name="us-east-1")  # change region

TARGET_RETENTION_DAYS = 7  # set per your policy

def set_backup_retention(db_instance_id, retention_days):
    print(f"Updating {db_instance_id} to BackupRetentionPeriod={retention_days}")
    response = rds.modify_db_instance(
        DBInstanceIdentifier=db_instance_id,
        BackupRetentionPeriod=retention_days,
        ApplyImmediately=True  # or False to wait for maintenance window
    )
    return response

def fix_all_instances_with_no_backups():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            name = db["DBInstanceIdentifier"]
            retention = db.get("BackupRetentionPeriod", 0)
            # Only update those with 0 (disabled)
            if retention == 0:
                set_backup_retention(name, TARGET_RETENTION_DAYS)

if __name__ == "__main__":
    fix_all_instances_with_no_backups()

4. Verify remediation​

import boto3

rds = boto3.client("rds", region_name="us-east-1")

def verify_retention():
    paginator = rds.get_paginator("describe_db_instances")
    for page in paginator.paginate():
        for db in page["DBInstances"]:
            print(
                db["DBInstanceIdentifier"],
                "-> BackupRetentionPeriod:",
                db.get("BackupRetentionPeriod"),
            )

if __name__ == "__main__":
    verify_retention()

5. Notes​

  • For Aurora clusters, use modify_db_cluster with BackupRetentionPeriod instead: 
    rds.modify_db_cluster(
        DBClusterIdentifier="my-aurora-cluster",
        BackupRetentionPeriod=7,
        ApplyImmediately=True
    )
  • BackupRetentionPeriod valid range is typically 1–35 (check the engine/region docs if needed).
Using Terraform
resource "aws_db_instance" "THIS_DB" {
  # Replace with your DB instance settings
  identifier        = "YOUR_DB_IDENTIFIER"
  engine            = "mysql"                 # or postgres, etc.
  instance_class    = "db.t3.medium"
  allocated_storage = 20
  username          = "YOUR_MASTER_USERNAME"
  password          = "YOUR_MASTER_PASSWORD"
  db_subnet_group_name = aws_db_subnet_group.this.name

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

If you are using Aurora or another RDS cluster, configure it on the cluster resource:

resource "aws_rds_cluster" "THIS_CLUSTER" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"
  engine             = "aurora-mysql"   # or aurora-postgresql, etc.
  master_username    = "YOUR_MASTER_USERNAME"
  master_password    = "YOUR_MASTER_PASSWORD"

  # Remediation: ensure automated backup retention is set (in days, 1–35)
  backup_retention_period = 7

  # ...other required arguments...
}

Changing backup_retention_period is an in‑place modification and does not force replacement of the DB instance or cluster.

After you add or change this argument, terraform plan should show an in-place update with a change like:

  • backup_retention_period: "0" => "7"