Control: RDS Aurora clusters should have backtracking enabled

Description

This control checks whether AWS Aurora clusters have backtracking enabled. Backups help you to recover more quickly from a security incident. They also strengthen the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to so.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.rds_db_cluster_aurora_backtracking_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.rds_db_cluster_aurora_backtracking_enabled --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when engine not ilike '%aurora-mysql%' then 'skip'
    when backtrack_window is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when engine not ilike '%aurora-mysql%' then title || ' not Aurora MySQL-compatible edition.'
    when backtrack_window is not null then title || ' backtracking enabled.'
    else title || ' backtracking not enabled.'
  end as reason
  
  , region, account_id
from
  aws_rds_db_cluster;

Control: RDS Aurora clusters should have backtracking enabled

Description

Usage

SQL

Tags