All checks
Medium
RDS DB instances should be protected by a backup plan
Confirms that each RDS DB instance is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point. Automated backups alone do not pass, as they are deleted with the instance unless retained. A resource assignment with both a resource list and a tag list must match both here.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
AWS Backup → Backup plans → the plan → Resource assignments → Assign resources
With the AWS CLI
aws backup create-backup-selection --backup-plan-id <backup-plan-id> --backup-selection '{"SelectionName":"rds-db-instances","IamRoleArn":"<backup-role-arn>","Resources":["<db-instance-arn>"]}' --region <region>With Terraform
resource "aws_backup_selection" "this" {
name = "rds-db-instances"
plan_id = var.backup_plan_id
iam_role_arn = var.backup_role_arn
resources = [var.db_instance_arn]
}See which of your accounts this check is failing on.
Book a demo