RDS.11: RDS instances should have automatic backups

What does AWS Security Hub RDS.11 check?

RDS.11 evaluates whether an RDS DB instance has automated backups enabled with an adequate retention period. It reports FAILED when backups are off (retention 0) or below the threshold — the Security Hub default is 7 days, configurable from 7 to 35 via the backupRetentionMinimum parameter. Read replicas are excluded, as their backups follow the source instance.

Why does RDS.11 matter?

Automated backups combine a daily snapshot with continuously archived transaction logs to give point-in-time recovery within the retention window. A retention of zero disables all of it — no daily snapshot, nothing to roll back to after a bad migration or a fat-fingered DELETE. It is rarely a deliberate choice: usually a quick-start default left unchanged, or someone disabling backups to silence a small storage cost without realising they traded a few cents of storage for the ability to ever recover.

How do I fix RDS.11?

1. Set a retention period with modify-db-instance --backup-retention-period 7 (or higher to meet your RPO).
2. Confirm the backup window falls in a low-traffic period.
3. Default a sensible retention into IaC templates so new instances are recoverable from creation.
4. Sign off any genuine zero-retention exception in writing.

# Set a 7-day backup floor on production databases below it (skip read replicas).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?ReadReplicaSourceDBInstanceIdentifier==`null` && BackupRetentionPeriod<`7`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --backup-retention-period 7 --no-apply-immediately
done

# Turn on DynamoDB point-in-time recovery (instant, no downtime).
aws dynamodb update-continuous-backups --table-name prod-orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Stop any snapshot in the account from being shared publicly, ever.
aws ec2 enable-snapshot-block-public-access --state block-all-sharing