Rule: RDS DB Instances Should Have Deletion Protection Enabled

RDS DB Instance Deletion Protection for CISA-Cyber Essentials Rule

Description:

Troubleshooting Steps:

2. 1.

   Identify the affected RDS DB instances: Review the list of RDS instances associated with the account and identify the ones that do not have deletion protection enabled.

4. 2.

   Verify the CISA-Cyber Essentials policy: Double-check the specific policy requirements to confirm that deletion protection is required for all RDS instances.

6. 3.

   Modify the affected RDS DB instance: Access the AWS Management Console or use the AWS CLI/API to modify the RDS instance settings.

8. 4.

   Enable deletion protection: Modify the RDS instance by enabling deletion protection using the appropriate AWS Management Console or CLI/API command.

10. 5.

    Verify the changes: After modifying the RDS instance, verify that deletion protection is now enabled. Check the instance configuration to ensure the setting has been updated successfully.

Necessary Code:

aws rds modify-db-instance --db-instance-identifier <instance-identifier> --deletion-protection true

<instance-identifier>

Step-by-Step Guide for Remediation:

2. 1.

   Identify the affected RDS DB instances: Log in to the AWS Management Console and navigate to the RDS service. Select the specific region where your instances are located.

4. 2.

   Review the RDS instances: In the RDS dashboard, locate the list of DB instances associated with your account. Identify the instances without deletion protection.

6. 3.

   Confirm CISA-Cyber Essentials requirement: Check the CISA-Cyber Essentials policy to verify that deletion protection is required for all RDS instances.

8. 4.

   Enable deletion protection: Use the AWS Management Console or the AWS CLI/API to enable deletion protection for the RDS instance.

   • For AWS Management Console:

     • Click on the target RDS DB instance name.
     • Go to the "Instance actions" menu and select "Modify".
     • Scroll down to the "Database Options" section.
     • Enable the "Deletion protection" option.
     • Click the "Apply immediately" button to save the changes.

   • For AWS CLI:

     • Open the terminal or command prompt.

     • Execute the following command, replacing

       <instance-identifier>

       with the identifier of the RDS instance:

       aws rds modify-db-instance --db-instance-identifier <instance-identifier> --deletion-protection true
       
10. 5.

    Verify the changes: Check the RDS instance configuration to confirm that deletion protection is now enabled. Review the instance details or use the

    describe-db-instances

    CLI command to ensure the setting has been updated successfully:

    • AWS CLI:

      aws rds describe-db-instances --db-instance-identifier <instance-identifier> --query 'DBInstances[0].[DBInstanceIdentifier,DeletionProtection]'
      

    Ensure that the output displays the correct instance identifier and

    true

    value for deletion protection.