Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · DocumentDB

DocumentDB.5: DocumentDB clusters should have deletion protection

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub DocumentDB.5 check?

DocumentDB.5 checks whether each DocumentDB cluster has the `DeletionProtection` flag enabled. It's a change-triggered Config rule on `AWS::RDS::DBCluster` that reports FAILED for any cluster where the flag is off, lighting up the moment a cluster is created or modified without it.

Why does DocumentDB.5 matter?

With protection off, a single `delete-db-cluster` call, an errant Terraform `destroy`, or a misconfigured automation can take the whole cluster and its data to zero in seconds. Accidental deletion is one of the highest-blast-radius mistakes in the cloud and one of the cheapest to prevent — the flag is free, instant, and reversible, while the cost of not having it is potentially your entire dataset.

How do I fix DocumentDB.5?

  1. Audit every cluster's protection state.
  2. Enable deletion protection on each unprotected cluster — no maintenance window needed.
  3. Bake the flag into provisioning templates so new clusters arrive protected.
  4. Document the safe path for intentional deletes (disable the flag, then delete).

Remediation script · bash

# Enable deletion protection on every unprotected standalone RDS instance in a region.
for id in $(aws rds describe-db-instances \
  --query 'DBInstances[?DeletionProtection==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --deletion-protection --apply-immediately
  echo "Protected RDS instance: $id"
done

# Termination-protect every production-tagged CloudFormation stack (eyeball the list first).
aws cloudformation describe-stacks \
  --query "Stacks[?Tags[?Key=='Environment' && Value=='production']].StackName" \
  --output text | tr '\t' '\n' | while read -r stack; do
  aws cloudformation update-termination-protection \
    --stack-name "$stack" --enable-termination-protection
  echo "Protected stack: $stack"
done

# Deletion-protect a production load balancer.
aws elbv2 modify-load-balancer-attributes --load-balancer-arn "$LB_ARN" \
  --attributes Key=deletion_protection.enabled,Value=true

Full walkthrough (console steps, edge cases and verification) in the lesson Enable deletion and termination protection.

Is DocumentDB.5 a false positive?

Deletion protection is on by default for clusters created in the console, so teams assume it's always set — but clusters created via CLI, SDK, or IaC frequently miss it, which is where the finding shows up.

Full lesson Enable deletion and termination protection Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for DocumentDB controls ↗ Check your own account for DocumentDB.5 →
Part of the learning path Lock down access

More DocumentDB controls