Put an expiry date on retained RDS automated backups after instance deletion

Retaining automated backups does not turn their rolling backup history into an indefinite archive.

Source facts

When an RDS instance is deleted, retained automated backups use the retention period configured at deletion. No new snapshots or logs are created, so the retained set eventually expires. Final snapshots are independent and do not expire automatically. AWS also states that retained automated backups do not include parameter- or option-group information and cannot be modified.

Source: AWS — Retaining automated backups.

Applicability

This applies to retained automated backups of RDS DB instances, not Multi-AZ DB clusters. Retention choices and snapshot existence do not prove that recovery configuration is complete.

DSE recommendation

DSE recommends assigning an owner and review date to every retained backup set during retirement. Record the last available recovery window and decide whether a final snapshot is needed for longer retention. Preserve the parameter and option-group design separately. Include backup storage and deletion decisions in the retirement record so a later cleanup does not silently remove the only approved recovery route. Record an explicit last review date before the retained range ends, with a named owner who can arrange any required longer-lived copy. Include recovery configuration alongside the data-retention decision so a future restore does not depend on a retired administrator’s memory.

Verification

Proposed verification: inspect the retained set’s identifiers and reported recovery range after an approved test deletion. Verify the separately retained final snapshot when one was requested. Perform a permitted restore with the intended configuration, then confirm that retention review and eventual cleanup have an accountable owner.

Official reference

AWS — Retaining automated backups. Reviewed October 20, 2026.