DocumentDB Cluster Should Have Deletion Protection Enabled

More Info:

Checks if an Amazon DocumentDB (with MongoDB compatibility) cluster has deletion protection enabled. The rule is NON_COMPLIANT if an Amazon DocumentDB cluster has the deletionProtection field set to false.

Risk Level

High

Address

Configuration

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of DocumentDB cluster not having deletion protection enabled in AWS RDS, you can follow these step-by-step instructions using the AWS Management Console:

1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.

2. Navigate to the Amazon DocumentDB Console: Click on the “Services” dropdown menu at the top of the page, then select “DocumentDB” under the Database category.

3. Select the DocumentDB Cluster: In the DocumentDB dashboard, locate the DocumentDB cluster that you want to enable deletion protection for, and click on its name to access its details.

4. Enable Deletion Protection: In the cluster details page, click on the “Modify” button at the top right corner.

5. Enable Deletion Protection Option: Scroll down to the “Deletion protection” section in the Modify cluster settings page.

6. Enable Deletion Protection: Check the box next to “Enable deletion protection” to turn on deletion protection for the DocumentDB cluster.

7. Save Changes: Scroll down to the bottom of the page and click on the “Modify cluster” button to save the changes.

8. Verify Deletion Protection: Once the modification is completed, go back to the DocumentDB cluster details page and ensure that the deletion protection status is now enabled.

By following these steps, you have successfully enabled deletion protection for the DocumentDB cluster in AWS RDS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI, follow these steps:

1. Install and Configure AWS CLI: If you haven’t already, install the AWS CLI and configure it with the necessary credentials by running:

   aws configure
   

   Follow the prompts to input your AWS Access Key ID, Secret Access Key, default region, and default output format.

2. Enable Deletion Protection for the DocumentDB Cluster: Run the following AWS CLI command to enable deletion protection for your DocumentDB cluster:

   aws docdb modify-db-cluster --db-cluster-identifier YOUR_CLUSTER_IDENTIFIER --deletion-protection
   

   Replace YOUR_CLUSTER_IDENTIFIER with the actual identifier of your DocumentDB cluster.

3. Verify the Deletion Protection Status: To verify that deletion protection has been successfully enabled for your DocumentDB cluster, you can describe the cluster using the following command:

   aws docdb describe-db-clusters --db-cluster-identifier YOUR_CLUSTER_IDENTIFIER
   

   Ensure that the DeletionProtection attribute in the output is set to true.

By following these steps, you can successfully remediate the misconfiguration of a DocumentDB cluster not having deletion protection enabled in AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of not having deletion protection enabled for an Amazon DocumentDB cluster in AWS using Python, you can use the AWS SDK for Python (boto3) to update the cluster configuration. Here are the step-by-step instructions:

1. Install the AWS SDK for Python (boto3) if you haven’t already:

pip install boto3

2. Create a Python script with the following code to enable deletion protection for the DocumentDB cluster:

import boto3

# Initialize the DocumentDB client
client = boto3.client('docdb')

# Specify the DocumentDB cluster identifier
cluster_identifier = 'your-cluster-identifier'

# Enable deletion protection for the DocumentDB cluster
response = client.modify_db_cluster(
    DBClusterIdentifier=cluster_identifier,
    DeletionProtection=True
)

# Print the response
print(response)

3. Replace 'your-cluster-identifier' with the actual identifier of your DocumentDB cluster.

4. Run the Python script. This will enable deletion protection for the specified DocumentDB cluster.

After following these steps, deletion protection will be enabled for your Amazon DocumentDB cluster, preventing accidental deletion of the cluster.

Using Terraform

resource "aws_docdb_cluster" "DOCDB_CLUSTER_NAME" {
  cluster_identifier = "DOCDB_CLUSTER_IDENTIFIER" # replace with your cluster identifier

  # ... other required arguments like master_username, master_password, engine, etc.

  deletion_protection = true
}

Changing deletion_protection to true does not force replacement of the cluster; AWS updates this setting in place.

After updating, terraform plan should show a single in-place change on the existing aws_docdb_cluster.DOCDB_CLUSTER_NAME resource with deletion_protection changing from false (or null) to true.

Additional Reading:

• https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-deletion-protection-enabled.html