Skip to main content

More Info:

Automated backups of your RDS database instances should be enabled to ensure point-in-time recovery.

Risk Level

High

Address

Operational Maturity, Reliability, Security

Compliance Standards

HIPAA, NIST, SOC2, HITRUST, AWSWAF, NISTCSF, PCIDSS

Triage and Remediation

  • Remediation

Remediation

Using Console

To remediate the misconfiguration of automated backups not being enabled for AWS RDS using the AWS Management Console, follow these steps:
  1. Sign in to the AWS Management Console:
  2. Navigate to RDS Service:
    • In the AWS Management Console, navigate to the Amazon RDS service by clicking on “Services” in the top left corner and then selecting “RDS” under the Database section.
  3. Select the RDS Instance:
    • From the list of RDS instances, select the instance for which you want to enable automated backups by clicking on its identifier.
  4. Enable Automated Backups:
    • In the RDS instance details page, click on the “Modify” button to change the configuration settings.
    • Scroll down to the “Backup” section, and under the “Backup retention period” option, select a retention period for automated backups (e.g., 7 days, 30 days, etc.).
    • Check the box for “Backup retention period” to enable automated backups.
    • You can also configure the preferred backup window and backup maintenance window according to your requirements.
    • Click on the “Continue” button.
  5. Apply Changes:
    • Review the changes you have made, and click on the “Modify DB Instance” button to apply the changes to the RDS instance.
  6. Monitor the Status:
    • Once the modification is complete, monitor the status of the RDS instance to ensure that automated backups are now enabled.
By following these steps, you have successfully enabled automated backups for the AWS RDS instance using the AWS Management Console. This will help ensure that regular backups are taken automatically, providing data protection and recovery options in case of any unforeseen incidents.

To enable automated backups for an AWS RDS instance using AWS CLI, follow these steps:
  1. Open your terminal or command prompt.
  2. Use the following AWS CLI command to modify the RDS instance to enable automated backups. Replace your-rds-instance-name with the actual name of your RDS instance.
aws rds modify-db-instance --db-instance-identifier your-rds-instance-name --backup-retention-period 7 --apply-immediately
  1. This command will modify the RDS instance to enable automated backups with a retention period of 7 days. You can adjust the --backup-retention-period parameter to set a different retention period as needed.
  2. After running the command, AWS will apply the changes immediately, and automated backups will be enabled for your RDS instance.
  3. You can verify that automated backups are enabled by checking the RDS instance details in the AWS Management Console or by running the following AWS CLI command:
aws rds describe-db-instances --db-instance-identifier your-rds-instance-name --query 'DBInstances[*].[DBInstanceIdentifier,DBInstanceArn,BackupRetentionPeriod,PreferredBackupWindow]'
  1. Look for the BackupRetentionPeriod value in the output to confirm that automated backups are enabled with the desired retention period.
By following these steps, you can successfully remediate the misconfiguration of automated backups not being enabled for an AWS RDS instance using AWS CLI.
To remediate the misconfiguration of automated backups not being enabled for an AWS RDS instance using Python, you can use the AWS SDK for Python (Boto3) to enable automated backups. Below are the step-by-step instructions to remediate this issue:
  1. Install Boto3: If you haven’t already installed Boto3, you can do so using pip by running the following command:
    pip install boto3
    
  2. Configure AWS Credentials: Make sure you have your AWS credentials configured either by setting environment variables or using AWS CLI aws configure.
  3. Write a Python script: Create a Python script with the following code to enable automated backups for an RDS instance. Replace your_rds_instance_identifier with the actual identifier of your RDS instance.
    import boto3
    
    rds = boto3.client('rds')
    
    instance_identifier = 'your_rds_instance_identifier'
    
    try:
        response = rds.modify_db_instance(
            DBInstanceIdentifier=instance_identifier,
            BackupRetentionPeriod=7,  # Set the number of days to retain backups
            ApplyImmediately=True
        )
        print(f"Automated backups enabled for RDS instance {instance_identifier}")
    except Exception as e:
        print(f"Error enabling automated backups: {str(e)}")
    
  4. Run the Python script: Execute the Python script to enable automated backups for the specified RDS instance. This script will set the backup retention period to 7 days. You can adjust this value as needed.
    python enable_rds_automated_backups.py
    
  5. Verify the configuration: After running the script, verify that automated backups have been enabled for the RDS instance by checking the AWS Management Console or using the AWS CLI.
By following these steps and running the Python script, you can remediate the misconfiguration of automated backups not being enabled for an AWS RDS instance.

Additional Reading:

I