RDS clusters should have deletion protection enabled

Confirms that RDS DB clusters have deletion protection enabled, so a stray delete of the cluster fails; it does not stop the data inside it being dropped. DocumentDB and Neptune clusters are evaluated too and take aws_docdb_cluster or aws_neptune_cluster, or the docdb or neptune form of modify-db-cluster.

service: RDS
severity: Medium
scope: evaluated in every region

How to fix it

In the console

RDS → Databases → the DB cluster → Modify → Deletion protection

With the AWS CLI

aws rds modify-db-cluster --db-cluster-identifier <db-cluster-id> --deletion-protection --region <region>

With Terraform

resource "aws_rds_cluster" "this" {
  engine              = var.engine
  deletion_protection = true
}

See which of your accounts this check is failing on.

Book a demo

RDS clusters should have deletion protection enabled

How to fix it

In the console

With the AWS CLI

With Terraform

More RDS checks