RDS DB clusters should have enough backup retention period set

Flags Amazon RDS DB clusters whose backup retention period is shorter than 7 days, which limits how far back a point-in-time restore can reach and so how long data corruption can go unnoticed and still be undone. DocumentDB and Neptune clusters are evaluated too; set it on aws_docdb_cluster or aws_neptune_cluster, or with the docdb or neptune form of modify-db-cluster.

service: RDS
severity: Medium
scope: evaluated in every region

How to fix it

In the console

RDS → Databases → the DB cluster → Modify (Amazon DocumentDB or Neptune console for those engines)

With the AWS CLI

aws rds modify-db-cluster --db-cluster-identifier <db-cluster-identifier> --backup-retention-period 7 --apply-immediately --region <region>

With Terraform

resource "aws_rds_cluster" "this" {
  engine                  = var.engine
  backup_retention_period = 7
}

See which of your accounts this check is failing on.

Book a demo

RDS DB clusters should have enough backup retention period set

How to fix it

In the console

With the AWS CLI

With Terraform

More RDS checks