Find RDS Instances Without Automated Backups or Encryption

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadBackupSettings",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EnableBackupsWithApply",
      "Effect": "Allow",
      "Action": "rds:ModifyDBInstance",
      "Resource": "arn:aws:rds:*:123456789012:db:*"
    }
  ]
}

// find-rds-instances-without-automated-backups.ts
// Reports, per Region, RDS DB instances and DB clusters with automated backups disabled
// (BackupRetentionPeriod 0), short retention, unencrypted storage or deletion protection off.
// Report-only by default. --apply turns on automated backups (BackupRetentionPeriod = --days)
// for standalone instances that have none; add --now to apply outside the maintenance window.
// Usage: npx tsx find-rds-instances-without-automated-backups.ts [--regions=us-east-1] [--days=7] [--apply [--now]]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  RDSClient,
  ModifyDBInstanceCommand,
  paginateDescribeDBClusters,
  paginateDescribeDBInstances,
} from "@aws-sdk/client-rds";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const now = args.includes("--now");
const value = (name: string): string | undefined => args.find((a) => a.startsWith(`--${name}=`))?.split("=")[1];
const regionArg = value("regions")?.split(",").map((r) => r.trim()).filter(Boolean);
const days = Number(value("days") ?? "7");
if (!Number.isInteger(days) || days < 1 || days > 35) throw new Error("--days must be an integer from 1 to 35");

interface Row {
  Region: string;
  Kind: "instance" | "replica" | "cluster";
  Name: string;
  Engine: string;
  Retention: number;
  Encrypted: boolean;
  DeletionProtection: boolean;
  Findings: string;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

function findings(kind: Row["Kind"], retention: number, encrypted: boolean, protectedFromDelete: boolean): string {
  const f: string[] = [];
  if (retention === 0 && kind !== "replica") f.push("NO AUTOMATED BACKUPS");
  else if (retention > 0 && retention < days) f.push(`retention ${retention}d < ${days}d`);
  if (!encrypted) f.push("UNENCRYPTED");
  if (!protectedFromDelete && kind !== "replica") f.push("no deletion protection");
  return f.join(", ") || "ok";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    const rds = new RDSClient({ region });
    try {
      // Aurora and Multi-AZ DB clusters: retention, encryption and deletion protection live on the cluster.
      for await (const page of paginateDescribeDBClusters({ client: rds }, {})) {
        for (const c of page.DBClusters ?? []) {
          const retention = c.BackupRetentionPeriod ?? 0;
          const enc = c.StorageEncrypted === true;
          const del = c.DeletionProtection === true;
          rows.push({ Region: region, Kind: "cluster", Name: c.DBClusterIdentifier ?? "?", Engine: c.Engine ?? "?", Retention: retention, Encrypted: enc, DeletionProtection: del, Findings: findings("cluster", retention, enc, del) });
        }
      }
      for await (const page of paginateDescribeDBInstances({ client: rds }, {})) {
        for (const db of page.DBInstances ?? []) {
          if (db.DBClusterIdentifier) continue; // covered by the cluster row
          const kind: Row["Kind"] = db.ReadReplicaSourceDBInstanceIdentifier ? "replica" : "instance";
          const retention = db.BackupRetentionPeriod ?? 0;
          const enc = db.StorageEncrypted === true;
          const del = db.DeletionProtection === true;
          rows.push({ Region: region, Kind: kind, Name: db.DBInstanceIdentifier ?? "?", Engine: db.Engine ?? "?", Retention: retention, Encrypted: enc, DeletionProtection: del, Findings: findings(kind, retention, enc, del) });
        }
      }
    } catch (err) {
      rows.push({ Region: region, Kind: "instance", Name: "?", Engine: "?", Retention: 0, Encrypted: false, DeletionProtection: false, Findings: `error: ${err instanceof Error ? err.name : String(err)}` });
    }
  }

  console.table(rows);
  const noBackups = rows.filter((r) => r.Kind === "instance" && r.Findings.includes("NO AUTOMATED BACKUPS"));
  const unencrypted = rows.filter((r) => r.Findings.includes("UNENCRYPTED"));
  console.log(`${rows.length} resource(s) checked: ${noBackups.length} without automated backups, ${unencrypted.length} unencrypted.`);

  if (!apply) {
    console.log(`Report only: nothing changed. --apply would set a ${days}-day retention on ${noBackups.length} instance(s).`);
  } else {
    for (const r of noBackups) {
      try {
        // Enabling backups can cause a brief I/O suspension. Without --now it waits for the maintenance window.
        await new RDSClient({ region: r.Region }).send(
          new ModifyDBInstanceCommand({ DBInstanceIdentifier: r.Name, BackupRetentionPeriod: days, ApplyImmediately: now }),
        );
        console.log(`${r.Region} ${r.Name}: retention set to ${days} days (${now ? "applying now" : "next maintenance window"})`);
      } catch (err) {
        console.log(`${r.Region} ${r.Name}: failed (${err instanceof Error ? err.message : String(err)})`);
      }
    }
  }
  if ((noBackups.length && !apply) || unencrypted.length) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-rds @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report every Region, treating anything under 14 days as short
AWS_PROFILE=readonly npx tsx find-rds-instances-without-automated-backups.ts --days=14

# Turn on 7-day backups at the next maintenance window
AWS_PROFILE=db-admin npx tsx find-rds-instances-without-automated-backups.ts --regions=us-east-1 --apply

# Same, but right now (brief I/O suspension)
AWS_PROFILE=db-admin npx tsx find-rds-instances-without-automated-backups.ts --regions=us-east-1 --apply --now

┌─────────┬─────────────┬────────────┬──────────────────────┬─────────────────────┬───────────┬───────────┬────────────────────┬─────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Kind       │ Name                 │ Engine              │ Retention │ Encrypted │ DeletionProtection │ Findings                                                    │
├─────────┼─────────────┼────────────┼──────────────────────┼─────────────────────┼───────────┼───────────┼────────────────────┼─────────────────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'instance' │ 'reporting-mysql'    │ 'mysql'             │ 0         │ false     │ false              │ 'NO AUTOMATED BACKUPS, UNENCRYPTED, no deletion protection' │
│ 1       │ 'eu-west-1' │ 'replica'  │ 'reporting-mysql-ro' │ 'mysql'             │ 0         │ false     │ false              │ 'UNENCRYPTED'                                               │
│ 2       │ 'us-east-1' │ 'cluster'  │ 'app-aurora'         │ 'aurora-postgresql' │ 1         │ true      │ true               │ 'retention 1d < 7d'                                         │
│ 3       │ 'us-east-1' │ 'instance' │ 'orders-pg'          │ 'postgres'          │ 14        │ true      │ true               │ 'ok'                                                        │
│ 4       │ 'us-east-1' │ 'instance' │ 'staging-pg'         │ 'postgres'          │ 0         │ true      │ false              │ 'NO AUTOMATED BACKUPS, no deletion protection'              │
└─────────┴─────────────┴────────────┴──────────────────────┴─────────────────────┴───────────┴───────────┴────────────────────┴─────────────────────────────────────────────────────────────┘
5 resource(s) checked: 2 without automated backups, 2 unencrypted.
Report only: nothing changed. --apply would set a 7-day retention on 2 instance(s).