Control: 14 Amazon Aurora clusters should have backtracking enabled

Description

This control checks whether Amazon Aurora clusters have backtracking enabled.

Backups help you to recover more quickly from a security incident. They also strengthens the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to do so.

Remediation

For detailed instructions to enable Aurora backtracking, see Configuring backtrack with the console when modifying a DB cluster.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_rds_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_rds_14 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when engine not ilike '%aurora-mysql%' then 'skip'
    when backtrack_window is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when engine not ilike '%aurora-mysql%' then title || ' not Aurora MySQL-compatible edition.'
    when backtrack_window is not null then title || ' backtracking enabled.'
    else title || ' backtracking not enabled.'
  end as reason
  
  , region, account_id
from
  aws_rds_db_cluster;

Control: 14 Amazon Aurora clusters should have backtracking enabled

Description

Remediation

Usage

SQL

Tags