Skip to main content

Instance Deletion Protection Should Be Enabled

More Info:​

Amazon RDS provides a Deletion Protection Flag which should be enabled to prevent accidental prevention of the database.

Risk Level​

Medium

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of "Instance Deletion Protection Should Be Enabled" for an AWS RDS instance using the AWS Management Console, follow these step-by-step instructions:

  1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.

  2. Navigate to the RDS Console: Click on the "Services" dropdown menu at the top of the page, then select "RDS" under the Database category.

  3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable deletion protection by clicking on its identifier.

  4. Enable Deletion Protection:

    • In the RDS instance details page, click on the "Modify" button located in the top right corner.

    • Scroll down to the "Backup" section of the Modify DB Instance page.

    • Find the "Deletion protection" option and check the box next to it to enable deletion protection for the RDS instance.

  5. Apply Changes: Scroll down to the bottom of the Modify DB Instance page and click on the "Continue" button.

  6. Review and Apply Changes: Review the changes you are about to make, and if everything looks correct, click on the "Modify DB Instance" button to apply the changes.

  7. Verify Deletion Protection: Once the modification is complete, go back to the list of RDS instances, select the instance you modified, and verify that deletion protection is enabled by checking the instance details.

By following these steps, you will successfully enable deletion protection for the AWS RDS instance, thereby remedying the misconfiguration of "Instance Deletion Protection Should Be Enabled".

Using CLI

To enable instance deletion protection for an AWS RDS instance using AWS CLI, follow these steps:

  1. Open the AWS CLI and run the following command to enable deletion protection for the RDS instance:
aws rds modify-db-instance --db-instance-identifier your-db-instance-name --no-deletion-protection

Replace your-db-instance-name with the actual name of your RDS instance.

  1. Verify that the deletion protection has been enabled for the RDS instance by running the following command:
aws rds describe-db-instances --db-instance-identifier your-db-instance-name --query 'DBInstances[*].[DBInstanceIdentifier,DeletionProtection]'

This command will return the information about the specified RDS instance, including the status of deletion protection.

By following these steps, you can successfully enable instance deletion protection for an AWS RDS instance using AWS CLI.

Using Python

To remediate the misconfiguration of Instance Deletion Protection not being enabled for an AWS RDS instance using Python, you can use the AWS SDK for Python (Boto3). Follow these steps:

  1. Install Boto3: If you haven't already installed the Boto3 library, you can do so using pip:

    pip install boto3

  2. Configure AWS Credentials: Make sure you have configured your AWS credentials either by setting environment variables or using the AWS CLI aws configure command.

  3. Write Python script: Create a Python script with the following code to enable Instance Deletion Protection for an AWS RDS instance:

    import boto3

    # Define the AWS region and the RDS instance identifier
    region = 'your_aws_region'
    rds_instance_identifier = 'your_rds_instance_identifier'

    # Create a RDS client
    rds_client = boto3.client('rds', region_name=region)

    # Enable Instance Deletion Protection for the RDS instance
    try:
        response = rds_client.modify_db_instance(
            DBInstanceIdentifier=rds_instance_identifier,
            DeletionProtection=True
        )
        print(f"Instance Deletion Protection enabled for RDS instance {rds_instance_identifier}")
    except Exception as e:
        print(f"Error enabling Instance Deletion Protection: {str(e)}")

  4. Replace your_aws_region and your_rds_instance_identifier with the appropriate values for your AWS environment.

  5. Run the Python script: Execute the Python script to enable Instance Deletion Protection for the specified AWS RDS instance.

By following these steps and running the Python script, you will be able to remediate the misconfiguration of Instance Deletion Protection not being enabled for an AWS RDS instance.

Using Terraform
resource "aws_db_instance" "THIS_DB" {
  # Substitute YOUR_DB_INSTANCE_IDENTIFIER with the DB instance identifier (must match the existing instance)
  identifier = "YOUR_DB_INSTANCE_IDENTIFIER"

  # ... other required arguments like engine, instance_class, username, etc.

  # Enable deletion protection (matches: aws rds modify-db-instance --deletion-protection)
  deletion_protection = true
}

Changing deletion_protection from false to true is an in-place modification and does not force replacement of the DB instance.

To verify, terraform plan should show an in-place update (~ on aws_db_instance.THIS_DB) with deletion_protection changing from false (or 0) to true (or 1).

Additional Reading:​