AWS DocumentDB clusters have backup retention period less than 7 days misconfiguration detected in c

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_360
Category - Subcategory	Storage - Backups
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	4ecc532c-f3ad-45a8-9eaa-e96ac5d4652c

Impact

This rule is checking to ensure that Amazon DocumentDB (DocDB) instances have a sufficient backup retention period. The backup retention period refers to the duration for which automated backups of DB instances are stored. Having an inadequate backup retention period can be detrimental in situations where data recovery is necessary. For instance, in cases of accidental deletion, data corruption, or even data tampering, backups play a significant role. If the backup retention period is too short, there might not be a valid backup available when it's most needed, leading to potential data loss. Therefore, this rule checks for and ensures that there is a substantial backup retention period for DocDB instances.

How to Fix

To mitigate this issue, ensure that the BackupRetentionPeriod property in the AWS::DocDB::DBCluster resource is set to at least 7 days.

Example: [source,go]

{ "Resources": { "MyDocDBCluster": { "Type": "AWS::DocDB::DBCluster", "Properties": { "BackupRetentionPeriod": 35, ... } } } }

Resources: MyDocDBCluster: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 35 ...