Back to Checks
aws

RDS instance has backup retention period greater than 0 days

rds_instance_backup_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for automated backups by confirming the backup retention period is greater than 0 days, indicating point-in-time recovery is configured.

Prowler logoProwlerprowler-provider-aws

Risk

Without automated backups, you lose point-in-time recovery, impacting availability and integrity.

Accidental deletes, destructive queries, or compromised accounts can cause unrecoverable data loss and prolonged outages, preventing reliable rollback during incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_backup_enabled

Recommendation

Enable automated backups with retention > 0 aligned to RPO/RTO. Regularly test restores to validate PITR.

Apply least privilege to backup access, encrypt snapshots, and replicate critical backups to separate locations for defense in depth and resilient recovery.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <db_instance_id> --backup-retention-period 1 --apply-immediately

Terraform

# Terraform: enable automated backups on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  allocated_storage      = 20
  engine                 = "mysql"
  instance_class         = "db.t3.micro"
  username               = "admin"
  password               = "<example_password>"
  backup_retention_period = 1  # CRITICAL: Enables automated backups (>0 days)
}

NativeIaC

# CloudFormation: enable automated backups on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t3.micro
      Engine: mysql
      AllocatedStorage: 20
      MasterUsername: admin
      MasterUserPassword: <example_password>
      BackupRetentionPeriod: 1  # CRITICAL: Enables automated backups (>0 days)

Other

1Open the AWS Management Console and go to RDS > Databases
2Select the target DB instance and click Modify
3In Backup section, set Backup retention period to 1 day (or more)
4Check Apply immediately
5Click Continue (if shown) and then Modify DB instance

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_backup_enabled(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            if db_instance.backup_retention_period > 0:
                report.status = "PASS"
                report.status_extended = f"RDS Instance {db_instance.id} has backup enabled with retention period {db_instance.backup_retention_period} days."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS Instance {db_instance.id} does not have backup enabled."
                )

            if db_instance.replica_source and not rds_client.audit_config.get(
                "check_rds_instance_replicas", False
            ):
                continue
            findings.append(report)

        return findings

References