RDS DB instance has copy tags to snapshots enabled

Check ID: rds_instance_copy_tags_to_snapshots
Provider: AWS
Service: rds
Severity: LOW
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are assessed for propagating instance tags to their DB snapshots using CopyTagsToSnapshot. Aurora engines manage this at the cluster level and aren’t evaluated per instance.

Risk

Snapshots without inherited tags lose ownership, environment, and sensitivity context, degrading visibility and governance. Missing metadata weakens ABAC, cost allocation, and lifecycle policies, enabling unintended backup access, orphaned snapshots, and retention drift that impact confidentiality and availability.

Recommendation

Enable CopyTagsToSnapshot on non-Aurora RDS instances so snapshots inherit required metadata. Establish a consistent tag taxonomy and automate enforcement to support least privilege via ABAC, cost tracking, and retention controls. For Aurora, configure tag copy at the cluster level.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <example_resource_id> —copy-tags-to-snapshot —apply-immediately

# Terraform: enable copying tags to snapshots on an RDS DB instance
resource "aws_db_instance" "<example_resource_name>" {
  copy_tags_to_snapshot = true  # Critical: ensures DB instance tags are copied to snapshots
}

# CloudFormation: enable copying tags to snapshots on an RDS DB instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      CopyTagsToSnapshot: true  # Critical: ensures DB instance tags are copied to snapshots

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_copy_tags_to_snapshots. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires