Back to Checks
aws

DocumentDB cluster has automated backups enabled with retention period of at least 7 days

documentdb_cluster_backup_enabled
Service: documentdbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Amazon DocumentDB clusters are evaluated for automated backups and an adequate backup retention period. Clusters should have backup_retention_period set to at least the configured minimum (default 7 days). Values of 0 indicate backups are disabled; values below the threshold are considered insufficient.

Prowler logoProwlerprowler-provider-aws

Risk

Without adequate backups, clusters can't be reliably restored. Accidental deletes, logical corruption, or ransomware may cause irreversible data loss once a short retention window expires, leading to prolonged outages, missed RPO/RTO, and limited ability to roll back malicious or erroneous changes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_backup_enabled

Recommendation

Enable automated backups and set retention to meet RPO/RTO (typically 7-35 days).

  • Regularly test point-in-time restores
  • Apply least privilege to backup/snapshot management
  • Protect backup artifacts and define stable backup windows
  • Include restores in a tested disaster recovery plan

Remediation

CLI

aws docdb modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --backup-retention-period 7 --apply-immediately

Terraform

# Terraform: Ensure DocumentDB backup retention is at least 7 days
resource "aws_docdb_cluster" "<example_resource_name>" {
  cluster_identifier      = "<example_resource_id>"
  backup_retention_period = 7  # CRITICAL: enables automated backups and sets retention to >=7 days
}

NativeIaC

# CloudFormation: Set DocumentDB backup retention to at least 7 days
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      BackupRetentionPeriod: 7  # CRITICAL: enables automated backups and sets retention to >=7 days

Other

1Open the Amazon DocumentDB console
2Go to Clusters and select <example_resource_id>
3Click Modify
4Set Backup retention period to 7 (or higher)
5Check Apply immediately
6Click Continue and then Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_backup_enabled(Check):
    def execute(self):
        findings = []
        for cluster in documentdb_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"DocumentDB Cluster {cluster.id} does not have backup enabled."
            )
            if cluster.backup_retention_period >= documentdb_client.audit_config.get(
                "minimum_backup_retention_period", 7
            ):
                report.status = "PASS"
                report.status_extended = f"DocumentDB Cluster {cluster.id} has backup enabled with retention period {cluster.backup_retention_period} days."
            else:
                if cluster.backup_retention_period > 0:
                    report.status = "FAIL"
                    report.check_metadata.Severity = Severity.low
                    report.status_extended = f"DocumentDB Cluster {cluster.id} has backup enabled with retention period {cluster.backup_retention_period} days. Recommended to increase the backup retention period to a minimum of 7 days."

            findings.append(report)

        return findings

References