RDS.8: RDS DB instances should have deletion protection

What does AWS Security Hub RDS.8 check?

RDS.8 checks whether the DeletionProtection flag is enabled on each standalone RDS DB instance (MySQL, MariaDB, PostgreSQL, Oracle, SQL Server). It reports FAILED for any such instance without the flag set.

Why does RDS.8 matter?

A delete on RDS is one of the few genuinely irreversible cloud operations the moment it completes, and the flag defaults to off: an instance from a Terraform module, a CloudFormation template, or a hurried console wizard arrives unprotected. The failure mode is silent until catastrophic: a protected and unprotected instance behave identically every normal day, and you only discover the difference at the exact moment a delete-db-instance would have gone through. The severity rating reflects likelihood, not blast radius; the thing it prevents is a deleted production database.

How do I fix RDS.8?

1. Enable it with modify-db-instance --deletion-protection.
2. Set the safe default in the IaC templates that create instances, since an unprotected instance usually signals templates spawning other unprotected resources too.
3. Track the count of production instances failing the control toward zero.
4. Disable protection only as a deliberate logged step when an instance must genuinely be deleted.

# Enable deletion protection on every unprotected standalone RDS instance in a region.
for id in $(aws rds describe-db-instances \
  --query 'DBInstances[?DeletionProtection==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --deletion-protection --apply-immediately
  echo "Protected RDS instance: $id"
done

# Termination-protect every production-tagged CloudFormation stack (eyeball the list first).
aws cloudformation describe-stacks \
  --query "Stacks[?Tags[?Key=='Environment' && Value=='production']].StackName" \
  --output text | tr '\t' '\n' | while read -r stack; do
  aws cloudformation update-termination-protection \
    --stack-name "$stack" --enable-termination-protection
  echo "Protected stack: $stack"
done

# Deletion-protect a production load balancer.
aws elbv2 modify-load-balancer-attributes --load-balancer-arn "$LB_ARN" \
  --attributes Key=deletion_protection.enabled,Value=true