Project: KICS (Provisioning / Security & Compliance)
File: 1dc73fb4-5b51-430c-8c5f-25dcf9090b02.md

title: RDS With Backup Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1dc73fb4-5b51-430c-8c5f-25dcf9090b02 Query name: RDS With Backup Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup<br> ```tf title="Positive test num. 1 - tf file" hl_lines="12" //some comments (used just for resource offset) resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" backupretentionperiod = 0 } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="12" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 autominorversion_upgrade = true backupretentionperiod = 0 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="1" module "db" { source = "terraform-aws-modules/rds/aws" version = "~>

identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 autominorversion_upgrade = true name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` </details> ```tf title="Negative test num. 1 - tf file" //some comments (used just for resource offset) resource "awsdbinstance" "negative1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" backupretentionperiod = 12 } ``` ```tf title="Negative test num. 2 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 autominorversion_upgrade = true backupretentionperiod = 12 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ```