Find RDS Databases Without Deletion Protection

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadDatabases",
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EnableProtectionWithApply",
      "Effect": "Allow",
      "Action": [
        "rds:ModifyDBInstance",
        "rds:ModifyDBCluster"
      ],
      "Resource": [
        "arn:aws:rds:*:123456789012:db:*",
        "arn:aws:rds:*:123456789012:cluster:*"
      ]
    }
  ]
}

// find-rds-without-deletion-protection.ts
// Lists RDS DB instances and Aurora / Multi-AZ DB clusters where deletion protection is off.
// Report only unless you pass --apply, which turns deletion protection on for the flagged databases.
// Usage:
//   npx tsx find-rds-without-deletion-protection.ts [--regions us-east-1,eu-west-1] [--names db1,db2] [--skip-replicas] [--apply]
import { ModifyDBClusterCommand, ModifyDBInstanceCommand, RDSClient, paginateDescribeDBClusters, paginateDescribeDBInstances, type Tag } from "@aws-sdk/client-rds";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const list = (v: string | undefined) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
const regions = list(flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1");
const onlyNames = new Set(list(flag("--names"))); // limit --apply to these identifiers
const skipReplicas = args.includes("--skip-replicas");
const apply = args.includes("--apply");

interface Row {
  Region: string;
  Kind: "cluster" | "instance" | "replica";
  Name: string;
  Engine: string;
  Env: string;
  Pending: string;
  Result: string;
}

const envTag = (tags: Tag[] | undefined) =>
  tags?.find((t) => ["env", "environment", "stage"].includes((t.Key ?? "").toLowerCase()))?.Value ?? "";

async function scanRegion(region: string): Promise<Row[]> {
  const rds = new RDSClient({ region });
  const rows: Row[] = [];

  // Aurora and Multi-AZ DB clusters: protection is a cluster setting.
  for await (const page of paginateDescribeDBClusters({ client: rds }, {})) {
    for (const c of page.DBClusters ?? []) {
      if (c.DeletionProtection) continue;
      rows.push({
        Region: region,
        Kind: "cluster",
        Name: c.DBClusterIdentifier ?? "?",
        Engine: c.Engine ?? "?",
        Env: envTag(c.TagList),
        Pending: c.PendingModifiedValues ? Object.keys(c.PendingModifiedValues).join(" ") : "",
        Result: "OFF",
      });
    }
  }

  // Standalone DB instances and read replicas. Cluster members inherit protection from the cluster row.
  for await (const page of paginateDescribeDBInstances({ client: rds }, {})) {
    for (const db of page.DBInstances ?? []) {
      if (db.DBClusterIdentifier || db.DeletionProtection) continue;
      const replica = Boolean(db.ReadReplicaSourceDBInstanceIdentifier || db.ReadReplicaSourceDBClusterIdentifier);
      if (replica && skipReplicas) continue;
      rows.push({
        Region: region,
        Kind: replica ? "replica" : "instance",
        Name: db.DBInstanceIdentifier ?? "?",
        Engine: db.Engine ?? "?",
        Env: envTag(db.TagList),
        Pending: db.PendingModifiedValues ? Object.keys(db.PendingModifiedValues).join(" ") : "",
        Result: "OFF",
      });
    }
  }

  if (!apply) return rows;
  for (const row of rows) {
    if (onlyNames.size && !onlyNames.has(row.Name)) {
      row.Result = "OFF (not in --names)";
      continue;
    }
    try {
      // ApplyImmediately stays false: deletion protection takes effect at once anyway, and true would
      // also push any pending modifications (instance class, engine version) out right now.
      if (row.Kind === "cluster") {
        await rds.send(new ModifyDBClusterCommand({ DBClusterIdentifier: row.Name, DeletionProtection: true, ApplyImmediately: false }));
      } else {
        await rds.send(new ModifyDBInstanceCommand({ DBInstanceIdentifier: row.Name, DeletionProtection: true, ApplyImmediately: false }));
      }
      row.Result = "ENABLED";
    } catch (err) {
      row.Result = `error: ${err instanceof Error ? err.name : String(err)}`;
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of regions) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  if (rows.length) console.table(rows);
  const enabled = rows.filter((r) => r.Result === "ENABLED").length;
  console.log(`${rows.length} databases without deletion protection in ${regions.join(", ")}`);
  console.log(apply ? `Deletion protection turned on for ${enabled} of them.` : "Report only. Re-run with --apply to turn deletion protection on.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-rds
npm install --save-dev tsx typescript @types/node

# Report for two Regions
AWS_PROFILE=readonly npx tsx find-rds-without-deletion-protection.ts --regions us-east-1,eu-west-1

# Protect two named databases
AWS_PROFILE=rds-admin npx tsx find-rds-without-deletion-protection.ts --regions us-east-1 --names orders-aurora,payments-pg --apply

┌─────────┬─────────────┬────────────┬─────────────────┬─────────────────────┬────────┬───────────────────┬────────────────────────┐
│ (index) │ Region      │ Kind       │ Name            │ Engine              │ Env    │ Pending           │ Result                 │
├─────────┼─────────────┼────────────┼─────────────────┼─────────────────────┼────────┼───────────────────┼────────────────────────┤
│ 0       │ 'us-east-1' │ 'cluster'  │ 'orders-aurora' │ 'aurora-postgresql' │ 'prod' │ ''                │ 'ENABLED'              │
│ 1       │ 'us-east-1' │ 'instance' │ 'payments-pg'   │ 'postgres'          │ 'prod' │ 'DBInstanceClass' │ 'ENABLED'              │
│ 2       │ 'us-east-1' │ 'instance' │ 'ci-tmp-4821'   │ 'mysql'             │ 'ci'   │ ''                │ 'OFF (not in --names)' │
└─────────┴─────────────┴────────────┴─────────────────┴─────────────────────┴────────┴───────────────────┴────────────────────────┘
3 databases without deletion protection in us-east-1
Deletion protection turned on for 2 of them.