AWS RDS Instance Backup

Severity: medium
Tags: AWS, Availability
Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html
Source: github.com/panther-labs/panther-analysis

This Policy ensures that RDS Instances have Backups enabled. Backups are an important aspect of disaster recovery that can protect sensitive data from destruction.

Rule body yaml

AnalysisType: policy
Filename: aws_rds_instance_backup.py
PolicyID: "AWS.RDS.InstanceBackup"
DisplayName: "AWS RDS Instance Backup"
Enabled: true
ResourceTypes:
  - AWS.RDS.Instance
Tags:
  - AWS
  - Availability
Severity: Medium
Description: >
  This Policy ensures that RDS Instances have Backups enabled. Backups are an important aspect
  of disaster recovery that can protect sensitive data from destruction.
Runbook: >
  https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-rds-instance-has-backups-enabled
Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html
Tests:
  - Name: RDS Instance Backup Disabled
    ExpectedResult: false
    Resource:
      {
        "AllocatedStorage": 20,
        "AssociatedRoles": null,
        "AutoMinorVersionUpgrade": true,
        "AvailabilityZone": "us-west-2a",
        "BackupRetentionPeriod": 0,
        "CACertificateIdentifier": "rds-ca-2015",
        "CharacterSetName": null,
        "CopyTagsToSnapshot": false,
        "DBClusterIdentifier": null,
        "DBInstanceArn": "arn:aws:rds:us-west-2:123456789012:db:example-instance",
        "DBInstanceClass": "db.m4.xlarge",
        "DBInstanceIdentifier": "example-instance",
        "DBInstanceStatus": "available",
        "DBName": "db_1",
        "DBParameterGroups":
          [
            {
              "DBParameterGroupName": "default.mysql5.7",
              "ParameterApplyStatus": "in-sync",
            },
          ],
        "DBSecurityGroups": null,
        "DBSubnetGroup":
          {
            "DBSubnetGroupArn": null,
            "DBSubnetGroupDescription": "default",
            "DBSubnetGroupName": "default",
            "SubnetGroupStatus": "Complete",
            "Subnets":
              [
                {
                  "SubnetAvailabilityZone": { "Name": "us-west-2b" },
                  "SubnetIdentifier": "subnet-111222333",
                  "SubnetStatus": "Active",
                },
                {
                  "SubnetAvailabilityZone": { "Name": "us-west-2d" },
                  "SubnetIdentifier": "subnet-444555666",
                  "SubnetStatus": "Active",
                },
              ],
            "VpcId": "vpc-111222333",
          },
        "DbInstancePort": 0,
        "DbiResourceId": "db-ABCDEFGHIJKLMNOP",
        "DeletionProtection": false,
        "DomainMemberships": null,
        "EnabledCloudwatchLogsExports": null,
        "Endpoint":
          {
            "Address": "example-instance.abcdefghijkl.us-west-2.rds.amazonaws.com",
            "HostedZoneId": "ABCDEF1234",
            "Port": 3306,
          },
        "Engine": "mysql",
        "EngineVersion": "5.7.22",
        "EnhancedMonitoringResourceArn": null,
        "IAMDatabaseAuthenticationEnabled": false,
        "InstanceCreateTime": "2019-01-01T00:00:00.000Z",
        "Iops": null,
        "KmsKeyId": "arn:aws:kms:us-west-2:123456789012:key/111222333",
        "LatestRestorableTime": "2019-01-01T00:00:00Z",
        "LicenseModel": "general-public-license",
        "ListenerEndpoint": null,
        "MasterUsername": "superuser",
        "MaxAllocatedStorage": null,
        "MonitoringInterval": 0,
        "MonitoringRoleArn": null,
        "MultiAZ": false,
        "OptionGroupMemberships":
          [{ "OptionGroupName": "default:mysql-5-7", "Status": "in-sync" }],
        "PendingModifiedValues":
          {
            "AllocatedStorage": null,
            "BackupRetentionPeriod": null,
            "CACertificateIdentifier": null,
            "DBInstanceClass": null,
            "DBInstanceIdentifier": null,
            "DBSubnetGroupName": null,
            "EngineVersion": null,
            "Iops": null,
            "LicenseModel": null,
            "MasterUserPassword": null,
            "MultiAZ": null,
            "PendingCloudwatchLogsExports": null,
            "Port": null,
            "ProcessorFeatures": null,
            "StorageType": null,
          },
        "PerformanceInsightsEnabled": false,
        "PerformanceInsightsKMSKeyId": null,
        "PerformanceInsightsRetentionPeriod": null,
        "PreferredBackupWindow": "07:31-08:01",
        "PreferredMaintenanceWindow": "thu:12:02-thu:12:32",
        "ProcessorFeatures": null,
        "PromotionTier": null,
        "PubliclyAccessible": true,
        "ReadReplicaDBClusterIdentifiers": null,
        "ReadReplicaDBInstanceIdentifiers": null,
        "ReadReplicaSourceDBInstanceIdentifier": null,
        "SecondaryAvailabilityZone": null,
        "SnapshotAttributes":
          [
            {
              "DBSnapshotAttributes":
                [{ "AttributeName": "restore", "AttributeValues": null }],
              "DBSnapshotIdentifier": "rds:example-instance-2019-01-01-07-36",
            },
            {
              "DBSnapshotAttributes":
                [{ "AttributeName": "restore", "AttributeValues": null }],
              "DBSnapshotIdentifier": "rds:example-instance-2019-01-08-07-36",
            },
          ],
        "StatusInfos": null,
        "StorageEncrypted": true,
        "StorageType": "gp2",
        "TdeCredentialArn": null,
        "Timezone": null,
        "VpcSecurityGroups":
          [{ "Status": "active", "VpcSecurityGroupId": "sg-112233" }],
      }
  - Name: RDS Instance Backup Enabled
    ExpectedResult: true
    Resource:
      {
        "AllocatedStorage": 20,
        "AssociatedRoles": null,
        "AutoMinorVersionUpgrade": true,
        "AvailabilityZone": "us-west-2a",
        "BackupRetentionPeriod": 7,
        "CACertificateIdentifier": "rds-ca-2015",
        "CharacterSetName": null,
        "CopyTagsToSnapshot": false,
        "DBClusterIdentifier": null,
        "DBInstanceArn": "arn:aws:rds:us-west-2:123456789012:db:example-instance",
        "DBInstanceClass": "db.m4.xlarge",
        "DBInstanceIdentifier": "example-instance",
        "DBInstanceStatus": "available",
        "DBName": "db_1",
        "DBParameterGroups":
          [
            {
              "DBParameterGroupName": "default.mysql5.7",
              "ParameterApplyStatus": "in-sync",
            },
          ],
        "DBSecurityGroups": null,
        "DBSubnetGroup":
          {
            "DBSubnetGroupArn": null,
            "DBSubnetGroupDescription": "default",
            "DBSubnetGroupName": "default",
            "SubnetGroupStatus": "Complete",
            "Subnets":
              [
                {
                  "SubnetAvailabilityZone": { "Name": "us-west-2b" },
                  "SubnetIdentifier": "subnet-111222333",
                  "SubnetStatus": "Active",
                },
                {
                  "SubnetAvailabilityZone": { "Name": "us-west-2d" },
                  "SubnetIdentifier": "subnet-444555666",
                  "SubnetStatus": "Active",
                },
              ],
            "VpcId": "vpc-111222333",
          },
        "DbInstancePort": 0,
        "DbiResourceId": "db-ABCDEFGHIJKLMNOP",
        "DeletionProtection": false,
        "DomainMemberships": null,
        "EnabledCloudwatchLogsExports": null,
        "Endpoint":
          {
            "Address": "example-instance.abcdefghijkl.us-west-2.rds.amazonaws.com",
            "HostedZoneId": "ABCDEF1234",
            "Port": 3306,
          },
        "Engine": "mysql",
        "EngineVersion": "5.7.22",
        "EnhancedMonitoringResourceArn": null,
        "IAMDatabaseAuthenticationEnabled": false,
        "InstanceCreateTime": "2019-01-01T00:00:00.000Z",
        "Iops": null,
        "KmsKeyId": "arn:aws:kms:us-west-2:123456789012:key/111222333",
        "LatestRestorableTime": "2019-01-01T00:00:00Z",
        "LicenseModel": "general-public-license",
        "ListenerEndpoint": null,
        "MasterUsername": "superuser",
        "MaxAllocatedStorage": null,
        "MonitoringInterval": 0,
        "MonitoringRoleArn": null,
        "MultiAZ": false,
        "OptionGroupMemberships":
          [{ "OptionGroupName": "default:mysql-5-7", "Status": "in-sync" }],
        "PendingModifiedValues":
          {
            "AllocatedStorage": null,
            "BackupRetentionPeriod": null,
            "CACertificateIdentifier": null,
            "DBInstanceClass": null,
            "DBInstanceIdentifier": null,
            "DBSubnetGroupName": null,
            "EngineVersion": null,
            "Iops": null,
            "LicenseModel": null,
            "MasterUserPassword": null,
            "MultiAZ": null,
            "PendingCloudwatchLogsExports": null,
            "Port": null,
            "ProcessorFeatures": null,
            "StorageType": null,
          },
        "PerformanceInsightsEnabled": false,
        "PerformanceInsightsKMSKeyId": null,
        "PerformanceInsightsRetentionPeriod": null,
        "PreferredBackupWindow": "07:31-08:01",
        "PreferredMaintenanceWindow": "thu:12:02-thu:12:32",
        "ProcessorFeatures": null,
        "PromotionTier": null,
        "PubliclyAccessible": true,
        "ReadReplicaDBClusterIdentifiers": null,
        "ReadReplicaDBInstanceIdentifiers": null,
        "ReadReplicaSourceDBInstanceIdentifier": null,
        "SecondaryAvailabilityZone": null,
        "SnapshotAttributes":
          [
            {
              "DBSnapshotAttributes":
                [{ "AttributeName": "restore", "AttributeValues": null }],
              "DBSnapshotIdentifier": "rds:example-instance-2019-01-01-07-36",
            },
            {
              "DBSnapshotAttributes":
                [{ "AttributeName": "restore", "AttributeValues": null }],
              "DBSnapshotIdentifier": "rds:example-instance-2019-01-08-07-36",
            },
          ],
        "StatusInfos": null,
        "StorageEncrypted": true,
        "StorageType": "gp2",
        "TdeCredentialArn": null,
        "Timezone": null,
        "VpcSecurityGroups":
          [{ "Status": "active", "VpcSecurityGroupId": "sg-112233" }],
      }

Detection logic

Condition

BackupRetentionPeriod not ne "0"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

Field	Kind	Excluded values
`BackupRetentionPeriod`	ne	`0`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

AWS RDS Instance Backup

Rule body yaml

Detection logic

Condition

Exclusions

Keyboard shortcuts

Search operators