Neptune DB cluster is configured to copy tags to snapshots.

​

What this check verifies

​

Risk

• Access control: Tag-based IAM conditions may not apply to snapshots, enabling unauthorized restore or copy
• Operational: Recovery, retention, and cost tracking can fail due to unidentifiable or orphaned snapshots

​

Recommendation

• Adopt a standardized tag taxonomy
• Use tag-based access controls and apply least privilege
• Automate tagging and policy checks in provisioning to prevent untagged snapshots

​

Remediation

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier     = "<DB_CLUSTER_ID>"
  copy_tags_to_snapshot  = true  # Inherit tags for snapshot governance and access control
}

Resources:
  NeptuneCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      DBClusterIdentifier: <DB_CLUSTER_ID>
      EngineVersion: neptune
      CopyTagsToSnapshot: true  # Inherit tags for snapshot governance and access control

​

References

• https://docs.aws.amazon.com/neptune/latest/userguide/tagging.html#tagging-overview
• https://www.cloudanix.com/docs/aws/audit/rdsmonitoring/rules/neptune_cluster_copy_tags_to_snapshot_enabled
• https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-8
• https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

​

Where this check fires