Cis AWS Database 2.8

2.8 Ensure Automatic Backups and Retention Policies are configured (Manual)

Description

Backups help protect your data from accidental loss or database failure. With Amazon Aurora, you can turn on automatic backups and specify a retention period. The backups include a daily snapshot of the entire DB instance and transaction logs.

Rationale

The individual logs into their account and chooses their database once selected they can modify the backup settings. To have the database being backed up automatically the individual is encouraged to select from 1 to 35 days. This ensures that the file is being saved automatically and can prevent it from accidental loss. This ensures that the individual can restore their files quickly in the event of a data loss.

Impact

It would result in having the files protected and being able to retrieve those files in the event of an accidental loss.

Audit Procedure

Using AWS Console

1. Sign in to AWS Management Console

   • If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.

2. Navigate to Amazon RDS Dashboard

   • Navigate to the RDS service once logged in to the AWS Management Console.
   • You can find this under the Database category.

3. Choose your Aurora DB instance

   • In the RDS Dashboard, click on Databases.
   • Then click on the name of your Aurora DB instance.

4. Check or modify the backup settings

   • In the Details section, find the Backup section.
   • Here, you can see if automatic backups are enabled (the Backup retention period is more than 0 days) and when the backup window is.
     • To modify these settings, click Modify.
     • In the Backup section of the Modify DB instance screen, you can change the Backup retention period and the Backup window.
     • The retention period can be between 1 and 35 days. To disable automatic backups, set the retention period to 0 days.

5. Apply the changes

   • Scroll to the bottom and choose when to apply the changes. You can apply them immediately or schedule them for the next maintenance window.
   • Then, click Continue and Modify DB Instance.

Expected Result

Automatic backups should be enabled with a Backup retention period greater than 0 days. The retention period should align with organizational data retention and recovery requirements (recommended: 7-35 days).

Remediation

This is important because it would allow the user to automatically save their files and instantly have access to their files when needed.

Follow the audit procedure steps above to configure automatic backups and set an appropriate retention period.

Default Value

Amazon Aurora automatically enables backups with a default retention period of 1 day.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual