RDS DB cluster has copy tags to snapshots enabled

Check ID: rds_cluster_copy_tags_to_snapshots
Provider: AWS
Service: rds
Severity: LOW
Resource type: AwsRdsDbCluster

What this check verifies

RDS DB clusters are evaluated for the CopyTagsToSnapshot setting that propagates cluster tags to their DB snapshots. Aurora tagging is configured at the cluster level; instance-level copying isn’t supported.

Risk

Missing tag propagation leaves snapshots without consistent metadata, weakening ABAC, ownership tracking, and retention controls. This can allow overly broad access to backups, hinder incident scoping, and inflate costs-impacting confidentiality and operational governance.

Recommendation

Enable CopyTagsToSnapshot on all applicable RDS/Aurora clusters.

Standardize required tags (owner, environment, data class)
Use least privilege and ABAC based on tags
Automate tagging and periodic audits so snapshots inherit metadata and lifecycle policies

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster —db-cluster-identifier <example_resource_id> —copy-tags-to-snapshot

# Terraform: enable copying tags to snapshots on an RDS DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  copy_tags_to_snapshot = true  # CRITICAL: ensures cluster tags are copied to snapshots
}

# CloudFormation: enable copying tags to snapshots on an RDS DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      CopyTagsToSnapshot: true  # CRITICAL: ensures cluster tags are copied to snapshots

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_copy_tags_to_snapshots. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires