RDS DB instances should be protected by a backup plan

How to fix it

In the console

AWS Backup → Backup plans → the plan → Resource assignments → Assign resources

IAM role

Default role, or a role allowed to back up RDS

Define resource selection

Include specific resource types (Include all resource types covers it only where RDS is opted in to AWS Backup)

Select resource types

RDS, with this DB instance left selected (by default every RDS resource is)

Refine selection using tags

Optional; the instance must match every tag condition you add

With the AWS CLI

aws backup create-backup-selection --backup-plan-id <backup-plan-id> --backup-selection '{"SelectionName":"rds-db-instances","IamRoleArn":"<backup-role-arn>","Resources":["<db-instance-arn>"]}' --region <region>

With Terraform

resource "aws_backup_selection" "this" {
  name         = "rds-db-instances"
  plan_id      = var.backup_plan_id
  iam_role_arn = var.backup_role_arn
  resources    = [var.db_instance_arn]
}