Login

Cloud Defense Logo

Products

Solutions

Company

Book A Live Demo

Rule: RDS DB Instance Protected by Backup Plan

This rule ensures that the RDS DB instance is protected by a backup plan to maintain data integrity and availability.

RuleRDS DB instance should be protected by backup plan
FrameworkSOC 2
Severity
✔
High

Amazon RDS Backup Compliance for SOC 2

Overview

SOC 2 compliance is a framework for managing data and ensuring the security, availability, privacy, and confidentiality of customer information. As such, an AWS RDS DB instance must adhere to strict backup policies to meet SOC 2 requirements. The rule here is that your RDS instances must be regularly backed up to prevent data loss and allow for recovery in the event of an incident.

RDS Backup Requirements for SOC 2

  • Automated backups should be enabled.
  • Backup retention periods must be in line with organizational data retention policies.
  • Backups should be encrypted to ensure data is protected during transit and at rest.
  • Regular backup testing should be performed to ensure that data recovery processes are effective.

Troubleshooting Backup Issues

If backups are not functioning as expected, follow these steps:

  2. 1.
    Check if automated backups are enabled.
  4. 2.
    Verify the backup retention period settings.
  6. 3.
    Ensure that the database instance has the necessary permissions for the backup service.
  8. 4.
    Confirm that there is adequate storage space for backups.
  10. 5.
    Review the RDS event logs for any backup-related errors.

Enabling and Configuring RDS Backups via AWS CLI

Enabling Automated Backups

aws rds modify-db-instance \
    --db-instance-identifier <your-db-instance-id> \
    --backup-retention-period <desired-retention-period-in-days> \
    --apply-immediately

Replace 

<your-db-instance-id>
with your actual DB instance identifier and 
<desired-retention-period-in-days>
with an integer representing the number of days you want to retain your backups (usually between 7-35 days, in alignment with your SOC 2 policy).

Configuring Backup Encryption

aws rds modify-db-instance \
    --db-instance-identifier <your-db-instance-id> \
    --storage-encrypted \
    --kms-key-id <your-kms-key-id> \
    --apply-immediately


<your-kms-key-id>
is the identifier for the AWS KMS key that you want to use to encrypt your backups.

Setting Backup Window

aws rds modify-db-instance \
    --db-instance-identifier <your-db-instance-id> \
    --preferred-backup-window <time-window> \
    --apply-immediately


<time-window>
should be replaced with your desired backup window time, using the format 
hh24:mi-hh24:mi
(e.g., 
00:00-03:00
).

Step by Step Guide for Remediation

To ensure SOC 2 compliance for RDS backup:

  2. 1.
    Log in to the Amazon RDS Console.
  4. 2.
    Select the RDS instance you want to configure.
  6. 3.
    Under the 'Instance Actions' dropdown, select 'Modify'.
  8. 4.
    In the 'Backup' section, set 'Backup Retention Period' to the required number of days.
  10. 5.
    Choose the 'Enable encryption' option for backups.
  12. 6.
    Select a Key Management Service (KMS) key for encryption.
  14. 7.
    Set the 'Backup Window' to a time that suits your workload.
  16. 8.
    Click 'Continue' and then 'Modify DB Instance' to apply changes.
  18. 9.
    To enforce these settings via AWS CLI, use the commands provided earlier with the appropriate parameters.

Following these guidelines and using the commands provided will help ensure that your RDS DB instances comply with SOC 2 backup requirements, enhancing your readiness for compliance audits.

Is your System Free of Underlying Vulnerabilities?
Find Out Now