Back to Checks
aws

RDS Aurora MySQL cluster has Backtrack enabled

rds_cluster_backtrack_enabled
Service: rdsSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Aurora MySQL DB clusters have Backtrack configured with a non-zero BacktrackWindow, retaining change records to allow rewinding to a consistent earlier time. Applies to aurora-mysql engines only.

Prowler logoProwlerprowler-provider-aws

Risk

Without Backtrack, destructive queries or admin mistakes can't be quickly undone, forcing snapshot/point-in-time restores. This increases recovery time, disrupts availability, and risks data integrity from partial restores or rollbacks.

Adversaries who alter data can cause longer impact windows before containment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_backtrack_enabled

Recommendation

Enable Backtrack on Aurora MySQL clusters and set BacktrackWindow to meet RTO while balancing cost and workload. Use it with automated backups for defense in depth and resilience.

For clusters without Backtrack, provision a clone or new cluster with it enabled; monitor usage and adjust the window as change rates evolve.

Remediation

CLI

aws rds restore-db-cluster-to-point-in-time --source-db-cluster-identifier <SOURCE_DB_CLUSTER_ID> --db-cluster-identifier <DB_CLUSTER_ID> --use-latest-restorable-time --backtrack-window 3600

Terraform

# Terraform: Aurora MySQL cluster with Backtrack enabled
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "aurora-mysql"
  master_username = "<MASTER_USERNAME>"
  master_password = "<MASTER_PASSWORD>"
  backtrack_window = 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes
}

NativeIaC

# CloudFormation: Create Aurora MySQL cluster with Backtrack enabled
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_PASSWORD>"
      BacktrackWindow: 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes

Other

1In the AWS Console, go to RDS > Databases and select the Aurora MySQL cluster
2Click Actions > Restore to point in time
3Choose Use latest restorable time
4Set Backtrack window (seconds) to a value > 0 (e.g., 3600)
5Enter a new DB cluster identifier and click Restore DB cluster
6Cut over applications to the new cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_backtrack_enabled(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=rds_client.db_clusters[db_cluster],
            )
            report.resource_arn = db_cluster
            report.status = "FAIL"
            report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} does not have backtrack enabled."
            # Only RDS Aurora MySQL clusters support backtrack.
            if rds_client.db_clusters[db_cluster].engine == "aurora-mysql":
                if rds_client.db_clusters[db_cluster].backtrack > 0:
                    report.status = "PASS"
                    report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} has backtrack enabled."

                findings.append(report)

        return findings

References