{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/aws-rds-retained-automated-backup-expiry-final-snapshot/", "item": { "id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "slug": "aws-rds-retained-automated-backup-expiry-final-snapshot", "url": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot.md", "json": "https://update.dsesecurity.com/api/v1/posts/aws-rds-retained-automated-backup-expiry-final-snapshot/" }, "title": "Put an expiry date on retained RDS automated backups after instance deletion", "summary": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:10+00:00", "modified_at": "2026-10-20T18:34:30+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 266, "potentially_affected": "This applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.", "dse_recommendation": "DSE recommends assigning an owner and review date to every retained backup set during retirement.", "primary_source": { "name": "AWS — Retaining automated backups", "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Retaining automated backups does not turn their rolling backup history into an indefinite archive.

\n

Source facts

\n

When an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.

\n

Source: AWS — Retaining automated backups.

\n

Applicability

\n

This applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.

\n

DSE recommendation

\n

DSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.

\n

Verification

\n

Proposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.

\n

Official reference

\n

AWS — Retaining automated backups. Reviewed October 20, 2026.

", "content_text": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.\nSource facts\nWhen an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.\nSource: AWS — Retaining automated backups.\nApplicability\nThis applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.\nDSE recommendation\nDSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.\nVerification\nProposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.\nOfficial reference\nAWS — Retaining automated backups. Reviewed October 20, 2026.", "content_markdown": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.\n\n## Source facts\n\nWhen an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.\n\nSource: [AWS — Retaining automated backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html).\n\n## Applicability\n\nThis applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.\n\n## DSE recommendation\n\nDSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.\n\n## Verification\n\nProposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.\n\n## Official reference\n\n[AWS — Retaining automated backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "url": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Put an expiry date on retained RDS automated backups after instance deletion", "item": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/#article", "identifier": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "url": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/", "headline": "Put an expiry date on retained RDS automated backups after instance deletion", "description": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.", "abstract": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.", "articleBody": "Retaining automated backups does not turn their rolling backup history into an indefinite archive.\nSource facts\nWhen an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.\nSource: AWS — Retaining automated backups.\nApplicability\nThis applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.\nDSE recommendation\nDSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.\nVerification\nProposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.\nOfficial reference\nAWS — Retaining automated backups. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:10+00:00", "dateModified": "2026-10-20T18:34:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Put an expiry date on retained RDS automated backups after instance deletion" }, "articleSection": [ "Business Continuity", "Cybersecurity", "IT" ], "keywords": [ "Business Continuity", "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 266, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS — Retaining automated backups", "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html" } } ] } }