Neptune cluster meets the minimum backup retention period

Check ID: neptune_cluster_backup_enabled
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

Neptune DB cluster automated backup is enabled and retention days are more than the required minimum retention period (default to 7 days).

Risk

Insufficient backup retention reduces the ability to recover from data corruption, accidental deletion, or ransomware, impacting availability and integrity.

Prevents point-in-time recovery to required dates
Increases downtime, irreversible data loss, and compliance violations

Recommendation

Ensure automated backups are enabled and retention aligns with your RPO/RTO and regulatory requirements (at least 7 days).

Define backup lifecycle and storage retention policies
Regularly test restore procedures and monitor backup health
Incorporate backups into Disaster Recovery and retention governance

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws neptune modify-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —backup-retention-period 7 —apply-immediately

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier      = var.cluster_id
  backup_retention_period = 7  # Enable automated backups with 7-day retention minimum
}

Parameters:
  DBClusterId:
    Type: String
Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: !Ref DBClusterId
      BackupRetentionPeriod: 7  # Enable automated backups with 7-day retention minimum

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_backup_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon MQ broker is not publicly accessible Neptune DB cluster is configured to copy tags to snapshots.

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires