RDS instance has backup retention period greater than 0 days
rds_instance_backup_enabled
RDS DB instances are evaluated for automated backups by confirming the backup retention period is greater than 0 days, indicating point-in-time recovery is configured.
Risk
Without automated backups, you lose point-in-time recovery, impacting availability and integrity.
Accidental deletes, destructive queries, or compromised accounts can cause unrecoverable data loss and prolonged outages, preventing reliable rollback during incidents.
prowler aws --checks rds_instance_backup_enabled
Recommendation
Enable automated backups with retention > 0 aligned to RPO/RTO. Regularly test restores to validate PITR.
Apply least privilege to backup access, encrypt snapshots, and replicate critical backups to separate locations for defense in depth and resilient recovery.
Remediation
aws rds modify-db-instance --db-instance-identifier <db_instance_id> --backup-retention-period 1 --apply-immediately
- Open the AWS Management Console and go to RDS > Databases
- Select the target DB instance and click Modify
- In Backup section, set Backup retention period to 1 day (or more)
- Check Apply immediately
- Click Continue (if shown) and then Modify DB instance
Source Code
Resource Type
AwsRdsDbInstance