Find and Delete Old RDS Manual Snapshots

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DescribeSnapshots",
      "Effect": "Allow",
      "Action": ["rds:DescribeDBSnapshots", "rds:DescribeDBClusterSnapshots"],
      "Resource": "*"
    },
    {
      "Sid": "DeleteManualSnapshots",
      "Effect": "Allow",
      "Action": ["rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot"],
      "Resource": [
        "arn:aws:rds:us-east-1:123456789012:snapshot:*",
        "arn:aws:rds:us-east-1:123456789012:cluster-snapshot:*"
      ]
    },
    {
      "Sid": "NeverDeleteKeptSnapshots",
      "Effect": "Deny",
      "Action": ["rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot"],
      "Resource": "*",
      "Condition": {
        "StringEqualsIgnoreCase": { "aws:ResourceTag/keep": "true" }
      }
    }
  ]
}

// delete-old-rds-snapshots.ts
// Finds manual RDS DB snapshots and manual Aurora / Multi-AZ cluster snapshots
// older than --days in the current Region. Read-only by default.
// --delete prints what would be deleted (dry run); --delete --apply deletes.
// Snapshots tagged keep=true are always skipped.
// Usage: npx tsx delete-old-rds-snapshots.ts [--days 90] [--delete [--apply]]
import {
  RDSClient,
  DeleteDBSnapshotCommand,
  DeleteDBClusterSnapshotCommand,
  paginateDescribeDBSnapshots,
  paginateDescribeDBClusterSnapshots,
  type Tag,
} from "@aws-sdk/client-rds";

type Snapshot = {
  kind: "instance" | "cluster";
  id: string;
  source: string;
  engine: string;
  created: Date;
  ageDays: number;
  allocatedGiB: number;
  status: string;
};

const DAY = 86_400_000;
const daysArg = process.argv.indexOf("--days");
const minAgeDays = daysArg > -1 ? Number(process.argv[daysArg + 1]) : 90;
if (!Number.isFinite(minAgeDays) || minAgeDays < 1) throw new Error("--days must be a positive number");
const doDelete = process.argv.includes("--delete");
const apply = process.argv.includes("--apply");

const rds = new RDSClient({});
const keep = (tags: Tag[] | undefined) =>
  (tags ?? []).some((t) => t.Key?.toLowerCase() === "keep" && t.Value?.toLowerCase() === "true");

async function findOldSnapshots(): Promise<Snapshot[]> {
  const now = Date.now();
  const found: Snapshot[] = [];

  // SnapshotType "manual" leaves out automated snapshots (they expire with the
  // backup retention period) and AWS Backup snapshots (type "awsbackup").
  for await (const page of paginateDescribeDBSnapshots({ client: rds }, { SnapshotType: "manual" })) {
    for (const s of page.DBSnapshots ?? []) {
      if (!s.DBSnapshotIdentifier || !s.SnapshotCreateTime || keep(s.TagList)) continue;
      found.push({
        kind: "instance",
        id: s.DBSnapshotIdentifier,
        source: s.DBInstanceIdentifier ?? "",
        engine: s.Engine ?? "",
        created: s.SnapshotCreateTime,
        ageDays: Math.floor((now - s.SnapshotCreateTime.getTime()) / DAY),
        allocatedGiB: s.AllocatedStorage ?? 0,
        status: s.Status ?? "",
      });
    }
  }

  // Aurora and Multi-AZ DB clusters keep their snapshots in a separate API.
  for await (const page of paginateDescribeDBClusterSnapshots({ client: rds }, { SnapshotType: "manual" })) {
    for (const s of page.DBClusterSnapshots ?? []) {
      if (!s.DBClusterSnapshotIdentifier || !s.SnapshotCreateTime || keep(s.TagList)) continue;
      found.push({
        kind: "cluster",
        id: s.DBClusterSnapshotIdentifier,
        source: s.DBClusterIdentifier ?? "",
        engine: s.Engine ?? "",
        created: s.SnapshotCreateTime,
        ageDays: Math.floor((now - s.SnapshotCreateTime.getTime()) / DAY),
        allocatedGiB: s.AllocatedStorage ?? 0,
        status: s.Status ?? "",
      });
    }
  }

  return found.filter((s) => s.ageDays > minAgeDays).sort((a, b) => a.created.getTime() - b.created.getTime());
}

async function main(): Promise<void> {
  const region = await rds.config.region();
  const old = await findOldSnapshots();
  console.log(`Manual snapshots older than ${minAgeDays} days in ${region}: ${old.length}`);
  console.table(
    old.map((s) => ({
      kind: s.kind,
      snapshot: s.id,
      source: s.source,
      engine: s.engine,
      created: s.created.toISOString().slice(0, 10),
      ageDays: s.ageDays,
      sourceGiB: s.allocatedGiB,
      status: s.status,
    })),
  );
  if (!doDelete) return;

  const deletable = old.filter((s) => s.status === "available");
  console.log(`\n${apply ? "Deleting" : "Dry run: would delete"} ${deletable.length} snapshots.`);
  for (const s of deletable) {
    console.log(`  ${s.kind.padEnd(8)} ${s.id}`);
    if (!apply) continue;
    if (s.kind === "instance") {
      await rds.send(new DeleteDBSnapshotCommand({ DBSnapshotIdentifier: s.id }));
    } else {
      await rds.send(new DeleteDBClusterSnapshotCommand({ DBClusterSnapshotIdentifier: s.id }));
    }
  }
  if (!apply && deletable.length > 0) console.log("Re-run with --delete --apply to delete them.");
}

main().catch((err: unknown) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-rds
npm install --save-dev tsx typescript

# Report manual snapshots older than 90 days
AWS_PROFILE=prod-readonly AWS_REGION=us-east-1 npx tsx delete-old-rds-snapshots.ts

# Older than 180 days, dry run of the delete
AWS_PROFILE=prod-admin AWS_REGION=us-east-1 npx tsx delete-old-rds-snapshots.ts --days 180 --delete

# Delete them
AWS_PROFILE=prod-admin AWS_REGION=us-east-1 npx tsx delete-old-rds-snapshots.ts --days 180 --delete --apply

# Protect a snapshot from the script (and from the Deny statement)
aws rds add-tags-to-resource \
  --resource-name arn:aws:rds:us-east-1:123456789012:snapshot:billing-db-final \
  --tags Key=keep,Value=true

Manual snapshots older than 180 days in us-east-1: 3
┌─────────┬────────────┬─────────────────────────────┬──────────────┬────────────────┬──────────────┬─────────┬───────────┬─────────────┐
│ (index) │ kind       │ snapshot                    │ source       │ engine         │ created      │ ageDays │ sourceGiB │ status      │
├─────────┼────────────┼─────────────────────────────┼──────────────┼────────────────┼──────────────┼─────────┼───────────┼─────────────┤
│ 0       │ 'instance' │ 'orders-db-pre-upgrade'     │ 'orders-db'  │ 'postgres'     │ '2025-01-14' │ 620     │ 400       │ 'available' │
│ 1       │ 'cluster'  │ 'analytics-before-migrate'  │ 'analytics'  │ 'aurora-mysql' │ '2025-06-02' │ 482     │ 250       │ 'available' │
│ 2       │ 'instance' │ 'orders-db-final'           │ 'orders-db'  │ 'postgres'     │ '2025-11-30' │ 301     │ 400       │ 'available' │
└─────────┴────────────┴─────────────────────────────┴──────────────┴────────────────┴──────────────┴─────────┴───────────┴─────────────┘

Dry run: would delete 3 snapshots.
  instance orders-db-pre-upgrade
  cluster  analytics-before-migrate
  instance orders-db-final
Re-run with --delete --apply to delete them.