Description

Detects AWS RDS database instances and clusters that have deletion protection disabled, which leaves them vulnerable to accidental or malicious deletion. Deletion protection is a critical security feature that helps prevent unintended database removal and data loss in production environments.

Detection Strategy

• Checks if an RDS database instance has deletion protection disabled (DeletionProtection = false)

• For RDS instances that are part of a cluster, verifies that neither the instance nor its parent cluster have deletion protection enabled

• Reports a vulnerability if an RDS instance or cluster can be deleted without additional safeguards