Back to Checks
aws

RDS cluster has deletion protection enabled

rds_cluster_deletion_protection
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

RDS DB clusters have deletion protection enabled (deletion_protection=true).

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, a cluster can be removed by error or misuse, causing sudden availability loss and potential data loss if backups are outdated. Compromised identities or faulty automation can trigger destructive deletes, degrading recoverability and data integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_deletion_protection

Recommendation

Enable deletion protection (deletion_protection=true) on production and other critical clusters. Enforce via IaC and organizational guardrails; apply least privilege to delete/modify actions; require change control and approvals. Maintain reliable backups to restore when protection must be lifted.

Remediation

CLI

aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --deletion-protection

Terraform

# Enable deletion protection on an existing RDS DB Cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  deletion_protection = true  # Critical: prevents cluster deletion and passes the check
}

NativeIaC

# CloudFormation: Enable deletion protection on an RDS DB Cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      DeletionProtection: true  # Critical: prevents cluster deletion and passes the check

Other

1In the AWS Console, go to RDS > Databases
2Select the DB cluster (type: DB cluster)
3Click Modify
4Enable Deletion protection
5Choose Apply immediately and click Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_deletion_protection(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=rds_client.db_clusters[db_cluster],
            )
            report.status = "FAIL"
            report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} does not have deletion protection enabled."
            if rds_client.db_clusters[db_cluster].deletion_protection:
                report.status = "PASS"
                report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} has deletion protection enabled."

            findings.append(report)

        return findings

References