Back to Checks
aws

RDS cluster is protected by an AWS Backup plan

rds_cluster_protected_by_backup_plan
Service: rdsSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

RDS DB clusters are covered by an AWS Backup backup plan when resource assignments include the cluster, either explicitly, by tags, or via an appropriate resource scope.

Prowler logoProwlerprowler-provider-aws

Risk

Lack of centralized backups enables irreversible data loss and corruption, reducing availability and integrity. Accidental deletion, ransomware, or bad changes may become unrecoverable. Weak retention or no immutability undermines rollback and can breach recovery objectives.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_protected_by_backup_plan

Recommendation

Include RDS clusters in an AWS Backup backup plan. Apply defense in depth: define schedules and retention, enable immutable vault controls and cross-Region copies, use tags for consistent coverage, enforce least privilege for backup roles, and regularly test restores to validate RPO/RTO.

Remediation

CLI

aws backup create-backup-selection --backup-plan-id <example_backup_plan_id> --backup-selection '{"SelectionName":"rds-clusters","IamRoleArn":"arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole","Resources":["arn:aws:rds:*:*:cluster:*"]}'

Terraform

# Assign RDS clusters to an existing AWS Backup plan
resource "aws_backup_selection" "<example_resource_name>" {
  name         = "rds-clusters"
  plan_id      = "<example_backup_plan_id>"
  iam_role_arn = "arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole"

  resources = [
    "arn:aws:rds:*:*:cluster:*" # Critical: includes all RDS clusters in the plan to pass the check
  ]
}

NativeIaC

# CloudFormation: assign RDS clusters to an AWS Backup plan
Resources:
  <example_resource_name>:
    Type: AWS::Backup::BackupSelection
    Properties:
      BackupPlanId: "<example_backup_plan_id>"
      BackupSelection:
        SelectionName: "rds-clusters"
        IamRoleArn: "arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole"
        Resources:
          - "arn:aws:rds:*:*:cluster:*"  # Critical: includes all RDS clusters in the plan to mark them protected

Other

1In the AWS Backup console, go to Settings > Service opt-in and enable RDS if it is not enabled.
2Go to Backup plans and select an existing plan (create a minimal plan if none exists).
3Click Assign resources.
4Set a name and choose IAM role: AWSBackupDefaultServiceRole.
5Under Resources, choose By resource ID and select the target RDS DB cluster (or use the ARN), then click Assign resources.
6The cluster now appears as protected by the backup plan.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.backup.backup_client import backup_client
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_protected_by_backup_plan(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"RDS Cluster {db_cluster.id} is not protected by a backup plan."
            )

            if (
                db_cluster.arn in backup_client.protected_resources
                or f"arn:{rds_client.audited_partition}:rds:*:*:cluster:*"
                in backup_client.protected_resources
                or "*" in backup_client.protected_resources
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Cluster {db_cluster.id} is protected by a backup plan."
                )

            findings.append(report)

        return findings

References