Aurora DB Clusters Should Have Recovery Point

More Info:

Checks if a recovery point was created for Amazon Aurora DB clusters. The rule is NON_COMPLIANT if the Amazon Relational Database Service (Amazon RDS) DB Cluster does not have a corresponding recovery point.

Risk Level

High

Address

Configuration

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of Aurora DB Clusters not having a recovery point in AWS RDS using the AWS Management Console, follow these steps:

1. Login to AWS Console: Go to the AWS Management Console (https://console.aws.amazon.com/) and login using your credentials.

2. Navigate to RDS Dashboard: Once logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown in the top left corner and selecting “RDS” under the Database category.

3. Select Aurora DB Cluster: From the list of DB instances, select the Aurora DB cluster that you want to configure a recovery point for by clicking on its identifier.

4. Enable Backtrack: In the Aurora DB cluster details page, click on the “Modify” button in the top right corner.

5. Configure Backtrack: Scroll down to the “Backup” section of the Modify DB Cluster page. Look for the “Backtrack” option and check the box to enable it.

6. Set Backtrack Window: Set the backtrack window to the desired number of seconds or minutes. This will determine how far back in time you can backtrack the cluster.

7. Review and Apply Changes: Review the other configuration settings to ensure they are correct. Once you have configured the backtrack settings, click on the “Continue” button.

8. Apply Changes: On the next page, review the summary of changes and click on the “Modify DB Cluster” button to apply the changes.

9. Monitor Progress: The modification process will start, and you can monitor the progress on the RDS dashboard. Once the modification is complete, the Aurora DB cluster will have a recovery point enabled.

By following these steps, you can successfully remediate the misconfiguration of Aurora DB Clusters not having a recovery point in AWS RDS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS using AWS CLI, you can follow these steps:

1. Create a DB Cluster Snapshot:

   • Use the following AWS CLI command to create a manual snapshot of your Aurora DB cluster:
     aws rds create-db-cluster-snapshot --db-cluster-identifier <your-db-cluster-identifier> --db-cluster-snapshot-identifier <your-snapshot-name>
     
   • Replace <your-db-cluster-identifier> with the identifier of your Aurora DB cluster and <your-snapshot-name> with the name you want to give to the snapshot.

2. Enable Automated Backups:

   • To ensure that automated backups are enabled for your Aurora DB cluster, use the following AWS CLI command:
     aws rds modify-db-cluster --db-cluster-identifier <your-db-cluster-identifier> --backup-retention-period <retention-period-in-days>
     
   • Replace <your-db-cluster-identifier> with the identifier of your Aurora DB cluster and <retention-period-in-days> with the number of days you want to retain automated backups.

3. Verify Backup Configuration:

   • Confirm that automated backups are enabled and the backup retention period is set correctly by running the following AWS CLI command:
     aws rds describe-db-clusters --db-cluster-identifier <your-db-cluster-identifier> --query "DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier, BackupRetentionPeriod:BackupRetentionPeriod, BackupWindow:PreferredBackupWindow, BackupRetentionPeriod:BackupRetentionPeriod}"
     
   • This command will display the backup configuration details of your Aurora DB cluster.

By following these steps and ensuring that you have created a manual snapshot, enabled automated backups, and verified the backup configuration, you can remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS using Python, you can follow these steps:

1. Install Boto3: Ensure that you have the Boto3 library installed in your Python environment. Boto3 is the AWS SDK for Python, which allows you to interact with AWS services.

pip install boto3

2. Create a Python script: Create a Python script with the following code to enable point-in-time recovery for your Aurora DB clusters.

import boto3

# Specify the AWS region where your Aurora DB cluster is located
region = 'your_aws_region'

# Specify the name of your Aurora DB cluster
db_cluster_identifier = 'your_db_cluster_identifier'

# Create a Boto3 RDS client
client = boto3.client('rds', region_name=region)

# Enable point-in-time recovery for the Aurora DB cluster
response = client.modify_db_cluster(
    DBClusterIdentifier=db_cluster_identifier,
    BackupRetentionPeriod=7,  # Specify the number of days to retain automated backups
    PreferredBackupWindow='04:00-04:30'  # Specify the preferred backup window
)

print("Point-in-time recovery enabled for Aurora DB cluster")

3. Replace placeholders: Replace your_aws_region with the AWS region where your Aurora DB cluster is located and your_db_cluster_identifier with the name of your Aurora DB cluster.

4. Run the script: Execute the Python script in your environment. This will enable point-in-time recovery for your Aurora DB cluster, ensuring that recovery points are available for data restoration.

By following these steps and running the Python script, you can remediate the misconfiguration of Aurora DB clusters not having a recovery point in AWS RDS.

Using Terraform

# Enable automated backups on the Aurora DB cluster (matches `modify-db-cluster --backup-retention-period 7`)

resource "aws_rds_cluster" "aurora_cluster" {
  cluster_identifier = "AURORA_CLUSTER_IDENTIFIER" # replace with your cluster id

  engine                 = "aurora-mysql"          # replace with your engine
  master_username        = "MASTER_USER"           # replace with your master username
  master_password        = "MASTER_PASSWORD"       # replace with your master password
  database_name          = "DB_NAME"               # replace with your DB name
  backup_retention_period = 7                      # 1–35, set to 7 to match the CLI remediation

  # ...any other required arguments for your cluster...
}

# Create a manual DB cluster snapshot (matches `create-db-cluster-snapshot`)

resource "aws_db_cluster_snapshot" "aurora_manual_snapshot" {
  db_cluster_snapshot_identifier = "MANUAL_SNAPSHOT_ID"    # choose a unique, stable identifier
  db_cluster_identifier          = aws_rds_cluster.aurora_cluster.id
}

Changing backup_retention_period on aws_rds_cluster is an in-place modification and does not force replacement of the cluster; adding aws_db_cluster_snapshot does not replace the cluster, it only creates and manages the snapshot (which will persist and incur storage costs until you remove the resource or set lifecycle { prevent_destroy = false } and destroy it).

To verify, terraform plan should show:

• An in-place update to aws_rds_cluster.aurora_cluster changing backup_retention_period to 7 (if it was different before).
• A new aws_db_cluster_snapshot.aurora_manual_snapshot resource to be created.

Additional Reading:

• https://docs.aws.amazon.com/config/latest/developerguide/aurora-last-backup-recovery-point-created.html