Back to Checks
aws

Neptune cluster has deletion protection enabled

neptune_cluster_deletion_protection
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Neptune DB cluster has deletion protection enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Absence of deletion protection weakens availability and integrity: clusters can be removed by accidental admin actions, rogue automation, or compromised credentials.

Cluster deletion causes immediate service outage, potential permanent data loss, and extended recovery time if backups or restores are insufficient.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_deletion_protection

Recommendation

Enable deletion protection for production Neptune clusters and apply the principles of least privilege and separation of duties for delete operations.

Enforce change-control approvals, restrict delete permissions to audited roles, and limit automated workflows that can perform destructive actions to prevent accidental or malicious deletions.

Remediation

CLI

aws neptune modify-db-cluster --db-cluster-identifier <DB_CLUSTER_IDENTIFIER> --deletion-protection --apply-immediately

Terraform

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier  = "<CLUSTER_ID>"
  deletion_protection = true  # Prevent accidental or malicious cluster deletion
}

NativeIaC

Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: <CLUSTER_ID>
      DeletionProtection: true  # Prevent accidental or malicious cluster deletion

Other

1Sign in to the AWS Management Console and open Amazon Neptune
2In the navigation pane, choose Databases
3Select the DB cluster and choose Modify
4Enable Deletion protection
5Choose Apply immediately (if shown) and then Modify DB cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_deletion_protection(Check):
    def execute(self):
        findings = []
        for cluster in neptune_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.resource_id = cluster.name
            report.status = "FAIL"
            report.status_extended = f"Neptune Cluster {cluster.name} does not have deletion protection enabled."
            if cluster.deletion_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"Neptune Cluster {cluster.name} has deletion protection enabled."
                )

            findings.append(report)

        return findings

References