Back to Checks
aws

Neptune cluster has automated backups enabled with retention period equal to or greater than the configured minimum

neptune_cluster_backup_enabled
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Neptune DB cluster automated backup is enabled and retention days are more than the required minimum retention period (default to 7 days).

Prowler logoProwlerprowler-provider-aws

Risk

Insufficient backup retention reduces the ability to recover from data corruption, accidental deletion, or ransomware, impacting availability and integrity.

  • Prevents point-in-time recovery to required dates
  • Increases downtime, irreversible data loss, and compliance violations

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_backup_enabled

Recommendation

Ensure automated backups are enabled and retention aligns with your RPO/RTO and regulatory requirements (at least 7 days).

  • Define backup lifecycle and storage retention policies
  • Regularly test restore procedures and monitor backup health
  • Incorporate backups into Disaster Recovery and retention governance

Remediation

CLI

aws neptune modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --backup-retention-period 7 --apply-immediately

Terraform

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier      = var.cluster_id
  backup_retention_period = 7  # Enable automated backups with 7-day retention minimum
}

NativeIaC

Parameters:
  DBClusterId:
    Type: String
Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: !Ref DBClusterId
      BackupRetentionPeriod: 7  # Enable automated backups with 7-day retention minimum

Other

1Sign in to the AWS Management Console
2Services → Amazon Neptune → Databases
3Select the DB cluster and click Modify
4In Backup retention period set the value to 7 (or higher)
5Choose Apply immediately and click Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_backup_enabled(Check):
    def execute(self):
        findings = []
        for cluster in neptune_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.resource_id = cluster.name
            report.status = "FAIL"
            report.status_extended = (
                f"Neptune Cluster {cluster.name} does not have backup enabled."
            )
            if cluster.backup_retention_period >= neptune_client.audit_config.get(
                "minimum_backup_retention_period", 7
            ):
                report.status = "PASS"
                report.status_extended = f"Neptune Cluster {cluster.name} has backup enabled with retention period {cluster.backup_retention_period} days."
            else:
                if cluster.backup_retention_period > 0:
                    report.status = "FAIL"
                    report.check_metadata.Severity = Severity.low
                    report.status_extended = f"Neptune Cluster {cluster.name} has backup enabled with retention period {cluster.backup_retention_period} days. Recommended to increase the backup retention period to a minimum of 7 days."

            findings.append(report)

        return findings

References