# Put an expiry date on retained RDS automated backups after instance deletion

> Retaining automated backups does not turn their rolling backup history into an indefinite archive.

- Canonical URL: https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:10+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Retaining automated backups does not turn their rolling backup history into an indefinite archive.

## Potentially affected

This applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.

## DSE recommendation

DSE recommends assigning an owner and review date to every retained backup set during retirement.

## Article

Retaining automated backups does not turn their rolling backup history into an indefinite archive.

## Source facts

When an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.

Source: [AWS — Retaining automated backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html).

## Applicability

This applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.

## DSE recommendation

DSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.

## Verification

Proposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.

## Official reference

[AWS — Retaining automated backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Retaining automated backups
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.Retaining.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Put an expiry date on retained RDS automated backups after instance deletion,” DSE Security, https://update.dsesecurity.com/updates/aws-rds-retained-automated-backup-expiry-final-snapshot/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.