RDS Aurora MySQL cluster has Backtrack enabled

Check ID: rds_cluster_backtrack_enabled
Provider: AWS
Service: rds
Severity: LOW
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

Aurora MySQL DB clusters have Backtrack configured with a non-zero BacktrackWindow, retaining change records to allow rewinding to a consistent earlier time. Applies to aurora-mysql engines only.

Risk

Without Backtrack, destructive queries or admin mistakes can’t be quickly undone, forcing snapshot/point-in-time restores. This increases recovery time, disrupts availability, and risks data integrity from partial restores or rollbacks. Adversaries who alter data can cause longer impact windows before containment.

Recommendation

Enable Backtrack on Aurora MySQL clusters and set BacktrackWindow to meet RTO while balancing cost and workload. Use it with automated backups for defense in depth and resilience. For clusters without Backtrack, provision a clone or new cluster with it enabled; monitor usage and adjust the window as change rates evolve.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds restore-db-cluster-to-point-in-time —source-db-cluster-identifier <SOURCE_DB_CLUSTER_ID> —db-cluster-identifier <DB_CLUSTER_ID> —use-latest-restorable-time —backtrack-window 3600

# Terraform: Aurora MySQL cluster with Backtrack enabled
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "aurora-mysql"
  master_username = "<MASTER_USERNAME>"
  master_password = "<MASTER_PASSWORD>"
  backtrack_window = 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes
}

# CloudFormation: Create Aurora MySQL cluster with Backtrack enabled
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_PASSWORD>"
      BacktrackWindow: 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_backtrack_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Organization has tag policies enabled and attached RDS DB cluster has copy tags to snapshots enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires