RDS instance has deletion protection enabled

Check ID: rds_instance_deletion_protection
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are assessed for deletion protection. If an instance belongs to an Aurora cluster, the setting is evaluated at the cluster level; otherwise, it is evaluated on the instance itself.

Risk

Without deletion protection, a user or pipeline can delete a database in one action, causing immediate loss of availability and possible data loss if backups are stale or missing. This heightens exposure to insider misuse, compromised credentials, or faulty automation, increasing recovery time and cost.

Recommendation

Enable deletion protection on production RDS instances and Aurora clusters. Enforce least privilege for delete/modify actions and require change control to disable protection. Use defense in depth with reliable backups and tested restores to limit impact if a deletion occurs.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <db_instance_id> —deletion-protection —apply-immediately

# Enable deletion protection on a standalone RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  deletion_protection = true  # Critical: prevents instance deletion
}

# Enable deletion protection on an RDS/Aurora cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  deletion_protection = true  # Critical: prevents cluster deletion (required for instances in this cluster)
}

# CloudFormation: enable deletion protection
Resources:
  <example_db_instance_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DeletionProtection: true  # Critical: enables deletion protection for standalone instances

  <example_db_cluster_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      DeletionProtection: true  # Critical: enables deletion protection at cluster level (required for Aurora members)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance does not use the default master username RDS instance uses a supported engine version

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires