RDS cluster is protected by an AWS Backup plan

Check ID: rds_cluster_protected_by_backup_plan
Provider: AWS
Service: rds
Severity: HIGH
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

RDS DB clusters are covered by an AWS Backup backup plan when resource assignments include the cluster, either explicitly, by tags, or via an appropriate resource scope.

Risk

Lack of centralized backups enables irreversible data loss and corruption, reducing availability and integrity. Accidental deletion, ransomware, or bad changes may become unrecoverable. Weak retention or no immutability undermines rollback and can breach recovery objectives.

Recommendation

Include RDS clusters in an AWS Backup backup plan. Apply defense in depth: define schedules and retention, enable immutable vault controls and cross-Region copies, use tags for consistent coverage, enforce least privilege for backup roles, and regularly test restores to validate RPO/RTO.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws backup create-backup-selection --backup-plan-id <example_backup_plan_id> --backup-selection '{"SelectionName":"rds-clusters","IamRoleArn":"arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole","Resources":["arn:aws:rds:*:*:cluster:*"]}'

# Assign RDS clusters to an existing AWS Backup plan
resource "aws_backup_selection" "<example_resource_name>" {
  name         = "rds-clusters"
  plan_id      = "<example_backup_plan_id>"
  iam_role_arn = "arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole"

  resources = [
    "arn:aws:rds:*:*:cluster:*" # Critical: includes all RDS clusters in the plan to pass the check
  ]
}

# CloudFormation: assign RDS clusters to an AWS Backup plan
Resources:
  <example_resource_name>:
    Type: AWS::Backup::BackupSelection
    Properties:
      BackupPlanId: "<example_backup_plan_id>"
      BackupSelection:
        SelectionName: "rds-clusters"
        IamRoleArn: "arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole"
        Resources:
          - "arn:aws:rds:*:*:cluster:*"  # Critical: includes all RDS clusters in the plan to mark them protected

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_protected_by_backup_plan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster uses a non-default port for its database engine RDS cluster storage is encrypted

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires