RDS instance has backup retention period greater than 0 days

Check ID: rds_instance_backup_enabled
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for automated backups by confirming the backup retention period is greater than 0 days, indicating point-in-time recovery is configured.

Risk

Without automated backups, you lose point-in-time recovery, impacting availability and integrity. Accidental deletes, destructive queries, or compromised accounts can cause unrecoverable data loss and prolonged outages, preventing reliable rollback during incidents.

Recommendation

Enable automated backups with retention > 0 aligned to RPO/RTO. Regularly test restores to validate PITR. Apply least privilege to backup access, encrypt snapshots, and replicate critical backups to separate locations for defense in depth and resilient recovery.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <db_instance_id> —backup-retention-period 1 —apply-immediately

# Terraform: enable automated backups on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  allocated_storage      = 20
  engine                 = "mysql"
  instance_class         = "db.t3.micro"
  username               = "admin"
  password               = "<example_password>"
  backup_retention_period = 1  # CRITICAL: Enables automated backups (>0 days)
}

# CloudFormation: enable automated backups on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t3.micro
      Engine: mysql
      AllocatedStorage: 20
      MasterUsername: admin
      MasterUserPassword: <example_password>
      BackupRetentionPeriod: 1  # CRITICAL: Enables automated backups (>0 days)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_backup_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster storage is encrypted RDS instance certificate has over 3 months validity left

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires