DocumentDB cluster has deletion protection enabled

Check ID: documentdb_cluster_deletion_protection
Provider: AWS
Service: documentdb
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

Amazon DocumentDB clusters are evaluated for the deletion_protection setting on the cluster configuration. The finding highlights clusters where this protection is not enabled.

Risk

Without deletion protection, clusters can be deleted by mistake or misuse, causing sudden outage and loss of recovery points, impacting availability and data integrity. Compromised accounts or faulty automation can remove databases or skip final snapshots, hindering restoration.

Recommendation

Enable deletion protection on all non-ephemeral clusters, prioritizing production. Enforce least privilege for delete and modify actions, require change control to toggle protection, and implement defense in depth with automation that continuously enforces this setting. Before decommissioning, take a final snapshot.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws docdb modify-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —deletion-protection —apply-immediately

# Terraform: Enable deletion protection on a DocumentDB cluster
resource "aws_docdb_cluster" "<example_resource_name>" {
  master_username     = "<MASTER_USERNAME>"
  master_password     = "<MASTER_USER_PASSWORD>"
  deletion_protection = true  # CRITICAL: Prevents cluster deletion until disabled
}

# CloudFormation: Enable deletion protection on a DocumentDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_USER_PASSWORD>"
      DeletionProtection: true  # CRITICAL: Prevents cluster deletion until disabled

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = documentdb_cluster_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DocumentDB exports audit and profiler logs to CloudWatch DocumentDB cluster has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires