AWS RDS Deletion Protection Disabled

This threat brief addresses the unauthorized modification of AWS RDS DB instances or clusters to disable the deletionProtection feature. Deletion protection is a security safeguard intended to prevent accidental or malicious deletion of database resources. Attackers who have obtained sufficient IAM permissions to modify cloud compute infrastructure often target this setting as a deliberate precursor to destructive activities, such as the total deletion of databases containing sensitive or business-critical information. Monitoring for the explicit removal of this safeguard provides a critical detection window for incident responders to intervene before data loss occurs. Defenders should distinguish between legitimate infrastructure-as-code deployments and interactive manual modifications by unauthorized users.

Attack Chain

1. Attacker gains persistence or elevates privileges within the AWS environment via compromised IAM credentials.
2. Attacker performs reconnaissance to identify high-value RDS instances and clusters using DescribeDBInstances or DescribeDBClusters.
3. Attacker checks the current configuration of the target RDS instance to confirm the state of deletionProtection.
4. Attacker executes ModifyDBInstance or ModifyDBCluster API calls with the deletionProtection=false parameter to remove the safeguard.
5. Attacker performs secondary destructive actions, such as disabling automated backups or snapshots to hinder recovery.
6. Attacker issues DeleteDBInstance or DeleteDBCluster commands to destroy the target database and impact availability.

Impact

Successful exploitation allows for the permanent deletion of mission-critical production databases. If an attacker disables deletion protection and subsequently deletes the database, the organization faces significant data loss, service outages, and potential regulatory non-compliance, depending on the nature of the data stored within the impacted RDS environment.

Recommendation

• Deploy the Sigma rule below to monitor CloudTrail for suspicious modifications to RDS deletion protection settings.
• Implement AWS Service Control Policies (SCPs) or IAM condition keys to restrict the ability of non-admin roles to modify deletionProtection.
• Review historical CloudTrail logs for accounts where ModifyDBInstance or ModifyDBCluster occurred with deletionProtection=false to identify potential prior unauthorized access.
• Establish an alerting workflow for DeleteDBInstance and DeleteDBCluster events to quickly identify and respond to attempted data destruction.