Back to Checks
aws

DocumentDB cluster has deletion protection enabled

documentdb_cluster_deletion_protection
Service: documentdbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Amazon DocumentDB clusters are evaluated for the deletion_protection setting on the cluster configuration.

The finding highlights clusters where this protection is not enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, clusters can be deleted by mistake or misuse, causing sudden outage and loss of recovery points, impacting availability and data integrity.

Compromised accounts or faulty automation can remove databases or skip final snapshots, hindering restoration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_deletion_protection

Recommendation

Enable deletion protection on all non-ephemeral clusters, prioritizing production.

Enforce least privilege for delete and modify actions, require change control to toggle protection, and implement defense in depth with automation that continuously enforces this setting. Before decommissioning, take a final snapshot.

Remediation

CLI

aws docdb modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --deletion-protection --apply-immediately

Terraform

# Terraform: Enable deletion protection on a DocumentDB cluster
resource "aws_docdb_cluster" "<example_resource_name>" {
  master_username     = "<MASTER_USERNAME>"
  master_password     = "<MASTER_USER_PASSWORD>"
  deletion_protection = true  # CRITICAL: Prevents cluster deletion until disabled
}

NativeIaC

# CloudFormation: Enable deletion protection on a DocumentDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_USER_PASSWORD>"
      DeletionProtection: true  # CRITICAL: Prevents cluster deletion until disabled

Other

1In the AWS Console, go to Amazon DocumentDB > Clusters
2Select the target cluster and click Modify
3Enable Deletion protection
4Check Apply immediately and click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_deletion_protection(Check):
    def execute(self):
        findings = []
        for cluster in documentdb_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"DocumentDB Cluster {cluster.id} does not have deletion protection enabled."
            if cluster.deletion_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"DocumentDB Cluster {cluster.id} has deletion protection enabled."
                )

            findings.append(report)

        return findings

References