RDS cluster has deletion protection enabled

Check ID: rds_cluster_deletion_protection
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

RDS DB clusters have deletion protection enabled (deletion_protection=true).

Risk

Without deletion protection, a cluster can be removed by error or misuse, causing sudden availability loss and potential data loss if backups are outdated. Compromised identities or faulty automation can trigger destructive deletes, degrading recoverability and data integrity.

Recommendation

Enable deletion protection (deletion_protection=true) on production and other critical clusters. Enforce via IaC and organizational guardrails; apply least privilege to delete/modify actions; require change control and approvals. Maintain reliable backups to restore when protection must be lifted.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster —db-cluster-identifier <db_cluster_id> —deletion-protection

# Enable deletion protection on an existing RDS DB Cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  deletion_protection = true  # Critical: prevents cluster deletion and passes the check
}

# CloudFormation: Enable deletion protection on an RDS DB Cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      DeletionProtection: true  # Critical: prevents cluster deletion and passes the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires