> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Rds backup retention days remediation ### Triage and Remediation ### Remediation To fix “Backup Retention Duration Should Be Present” for an AWS RDS instance via the AWS Console, you need to enable/adjust **Automated Backups** (Backup retention period > 0). ### For an existing RDS DB instance 1. **Sign in** to the AWS Management Console and go to **RDS**. 2. In the left menu, click **Databases**. 3. Select the **DB instance** you want to fix. 4. Click **Modify** (top right). 5. Scroll to the **Additional configuration** (or **Backup**) section: * Find **Backup retention period**. * Set it to a value between **1 and 35 days** (e.g., 7). * Optionally adjust **Backup window** if you want a specific time. 6. Scroll down and click **Continue**. 7. Under **Scheduling of modifications**, choose: * **Apply immediately** (for instant change), or * **During the next maintenance window** (safer for production). 8. Click **Modify DB instance** to save. ### For a new RDS DB instance 1. In **RDS Console** → **Databases** → **Create database**. 2. Choose engine and template as usual. 3. In **Additional configuration** / **Backup** section: * Set **Backup retention period** to **≥ 1** day. * Configure backup window if desired. 4. Complete other settings and click **Create database**. Once the retention period is > 0, the “Backup Retention Duration Should Be Present” finding for that RDS instance should be resolved. For Amazon RDS, “Backup Retention Duration Should Be Present” means the automated backup retention period must be set to a non-zero value (for Aurora: set on the cluster; for non-Aurora: on the instance). Below are step‑by‑step AWS CLI instructions. *** ## 1. Identify RDS Instances with Backup Retention = 0 ```bash theme={null} aws rds describe-db-instances \ --query "DBInstances[?BackupRetentionPeriod==\`0\`].[DBInstanceIdentifier,Engine,BackupRetentionPeriod]" \ --output table ``` This lists RDS instances that have automated backups disabled. *** ## 2. Decide Your Desired Retention Period Choose a value between 1 and 35 (days), according to your policy (e.g., 7 or 30 days).\ In the examples below, I’ll use `7`. *** ## 3. Remediate Non-Aurora RDS Instances Replace `my-db-instance-id` and `7` with your values. ```bash theme={null} aws rds modify-db-instance \ --db-instance-identifier my-db-instance-id \ --backup-retention-period 7 \ --apply-immediately ``` Key flags: * `--backup-retention-period 7` → enables automated backups, keeps 7 days * `--apply-immediately` → apply change right away (omit if you prefer next maintenance window) Repeat for each instance that had `BackupRetentionPeriod == 0`. *** ## 4. Remediate Aurora Clusters (if using Aurora) For Aurora, retention is configured at the **cluster** level. ### 4.1. Find Aurora clusters with retention = 0 ```bash theme={null} aws rds describe-db-clusters \ --query "DBClusters[?BackupRetentionPeriod==\`0\`].[DBClusterIdentifier,Engine,BackupRetentionPeriod]" \ --output table ``` ### 4.2. Set retention on each cluster ```bash theme={null} aws rds modify-db-cluster \ --db-cluster-identifier my-aurora-cluster-id \ --backup-retention-period 7 \ --apply-immediately ``` *** ## 5. Verify the Change For a specific instance: ```bash theme={null} aws rds describe-db-instances \ --db-instance-identifier my-db-instance-id \ --query "DBInstances[0].[DBInstanceIdentifier,BackupRetentionPeriod]" \ --output table ``` For a specific Aurora cluster: ```bash theme={null} aws rds describe-db-clusters \ --db-cluster-identifier my-aurora-cluster-id \ --query "DBClusters[0].[DBClusterIdentifier,BackupRetentionPeriod]" \ --output table ``` Once `BackupRetentionPeriod` is greater than 0, the misconfiguration is remediated. For AWS RDS, “Backup Retention Duration Should Be Present” means `BackupRetentionPeriod` must be > 0 (automated backups enabled). Below is how to remediate it using Python (boto3). ### 1. Prerequisites * Install and configure AWS CLI or set env vars so boto3 has credentials: ```bash theme={null} pip install boto3 aws configure ``` * Ensure your IAM role/user has: * `rds:DescribeDBInstances` * `rds:ModifyDBInstance` *** ### 2. Identify RDS instances with no backup retention ```python theme={null} import boto3 rds = boto3.client("rds", region_name="us-east-1") # change region if needed def list_instances_with_no_backups(): paginator = rds.get_paginator("describe_db_instances") bad_instances = [] for page in paginator.paginate(): for db in page["DBInstances"]: name = db["DBInstanceIdentifier"] retention = db.get("BackupRetentionPeriod", 0) if retention == 0: bad_instances.append((name, retention)) return bad_instances if __name__ == "__main__": instances = list_instances_with_no_backups() if not instances: print("All RDS instances have backup retention > 0.") else: print("Instances with BackupRetentionPeriod=0:") for name, retention in instances: print(f" - {name} (BackupRetentionPeriod={retention})") ``` *** ### 3. Remediate: set a proper backup retention period Pick a standard (e.g., 7 days). Adjust based on your policy. ```python theme={null} import boto3 rds = boto3.client("rds", region_name="us-east-1") # change region TARGET_RETENTION_DAYS = 7 # set per your policy def set_backup_retention(db_instance_id, retention_days): print(f"Updating {db_instance_id} to BackupRetentionPeriod={retention_days}") response = rds.modify_db_instance( DBInstanceIdentifier=db_instance_id, BackupRetentionPeriod=retention_days, ApplyImmediately=True # or False to wait for maintenance window ) return response def fix_all_instances_with_no_backups(): paginator = rds.get_paginator("describe_db_instances") for page in paginator.paginate(): for db in page["DBInstances"]: name = db["DBInstanceIdentifier"] retention = db.get("BackupRetentionPeriod", 0) # Only update those with 0 (disabled) if retention == 0: set_backup_retention(name, TARGET_RETENTION_DAYS) if __name__ == "__main__": fix_all_instances_with_no_backups() ``` *** ### 4. Verify remediation ```python theme={null} import boto3 rds = boto3.client("rds", region_name="us-east-1") def verify_retention(): paginator = rds.get_paginator("describe_db_instances") for page in paginator.paginate(): for db in page["DBInstances"]: print( db["DBInstanceIdentifier"], "-> BackupRetentionPeriod:", db.get("BackupRetentionPeriod"), ) if __name__ == "__main__": verify_retention() ``` *** ### 5. Notes * For Aurora clusters, use `modify_db_cluster` with `BackupRetentionPeriod` instead: ```python theme={null} rds.modify_db_cluster( DBClusterIdentifier="my-aurora-cluster", BackupRetentionPeriod=7, ApplyImmediately=True ) ``` * `BackupRetentionPeriod` valid range is typically `1–35` (check the engine/region docs if needed). ```hcl theme={null} resource "aws_db_instance" "THIS_DB" { # Replace with your DB instance settings identifier = "YOUR_DB_IDENTIFIER" engine = "mysql" # or postgres, etc. instance_class = "db.t3.medium" allocated_storage = 20 username = "YOUR_MASTER_USERNAME" password = "YOUR_MASTER_PASSWORD" db_subnet_group_name = aws_db_subnet_group.this.name # Remediation: ensure automated backup retention is set (in days, 1–35) backup_retention_period = 7 # ...other required arguments... } ``` If you are using Aurora or another RDS cluster, configure it on the cluster resource: ```hcl theme={null} resource "aws_rds_cluster" "THIS_CLUSTER" { cluster_identifier = "YOUR_CLUSTER_IDENTIFIER" engine = "aurora-mysql" # or aurora-postgresql, etc. master_username = "YOUR_MASTER_USERNAME" master_password = "YOUR_MASTER_PASSWORD" # Remediation: ensure automated backup retention is set (in days, 1–35) backup_retention_period = 7 # ...other required arguments... } ``` Changing `backup_retention_period` is an in‑place modification and does not force replacement of the DB instance or cluster. After you add or change this argument, `terraform plan` should show an in-place update with a change like: * `backup_retention_period: "0" => "7"`