Neptune cluster has deletion protection enabled

Check ID: neptune_cluster_deletion_protection
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: resilience
Resource type: Other

Risk

Absence of deletion protection weakens availability and integrity: clusters can be removed by accidental admin actions, rogue automation, or compromised credentials.

Cluster deletion causes immediate service outage, potential permanent data loss, and extended recovery time if backups or restores are insufficient.

Recommendation

Enable deletion protection for production Neptune clusters and apply the principles of least privilege and separation of duties for delete operations.

Enforce change-control approvals, restrict delete permissions to audited roles, and limit automated workflows that can perform destructive actions to prevent accidental or malicious deletions.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws neptune modify-db-cluster —db-cluster-identifier <DB_CLUSTER_IDENTIFIER> —deletion-protection —apply-immediately

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier  = "<CLUSTER_ID>"
  deletion_protection = true  # Prevent accidental or malicious cluster deletion
}

Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: <CLUSTER_ID>
      DeletionProtection: true  # Prevent accidental or malicious cluster deletion

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Neptune cluster has deletion protection enabled

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires