DocumentDB cluster keeps backups for 7 days or more

Check ID: documentdb_cluster_backup_enabled
Provider: AWS
Service: documentdb
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

Amazon DocumentDB clusters are evaluated for automated backups and an adequate backup retention period. Clusters should have backup_retention_period set to at least the configured minimum (default 7 days). Values of 0 indicate backups are disabled; values below the threshold are considered insufficient.

Risk

Without adequate backups, clusters can’t be reliably restored. Accidental deletes, logical corruption, or ransomware may cause irreversible data loss once a short retention window expires, leading to prolonged outages, missed RPO/RTO, and limited ability to roll back malicious or erroneous changes.

Recommendation

Enable automated backups and set retention to meet RPO/RTO (typically 7-35 days).

Regularly test point-in-time restores
Apply least privilege to backup/snapshot management
Protect backup artifacts and define stable backup windows
Include restores in a tested disaster recovery plan

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws docdb modify-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —backup-retention-period 7 —apply-immediately

# Terraform: Ensure DocumentDB backup retention is at least 7 days
resource "aws_docdb_cluster" "<example_resource_name>" {
  cluster_identifier      = "<example_resource_id>"
  backup_retention_period = 7  # CRITICAL: enables automated backups and sets retention to >=7 days
}

# CloudFormation: Set DocumentDB backup retention to at least 7 days
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      BackupRetentionPeriod: 7  # CRITICAL: enables automated backups and sets retention to >=7 days

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = documentdb_cluster_backup_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS replication task logs TARGET_APPLY and TARGET_LOAD DocumentDB exports audit and profiler logs to CloudWatch

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires