RDS deletion protection

Prevents the deletion of RDS database instances, providing an additional layer of protection for your critical database infrastructure.

Policy description

What this SCP does

This Service Control Policy (SCP) prevents the deletion of RDS database instances, providing an additional layer of protection for your critical database infrastructure. This helps prevent accidental or unauthorized deletion of database resources.

The policy blocks all RDS deletion operations across the organization, ensuring that database resources cannot be removed without explicitly removing this protection. This is particularly valuable for protecting production databases from accidental deletion.

Validation strategy

How to test this SCP works

To validate this SCP, try to create a test database instance and then attempt to delete it.

Valid test: Create an RDS database instance (should succeed)
Invalid test: Delete the RDS database instance (should be denied)

We expect the deletion operation to be denied with an AccessDenied error. Note that if the policy works as intended, you will need to temporarily remove or modify the SCP to clean up the test database instance.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyRDSDeletion", "Effect": "Deny", "Action": "rds:Delete*", "Resource": "*" } ] }

# Create a test RDS instance aws rds create-db-instance \ --db-instance-identifier test-protected-db \ --db-instance-class db.t3.micro \ --engine mysql \ --master-username admin \ --master-user-password Password123! \ --allocated-storage 20 # Try to delete the RDS instance (this should be denied) aws rds delete-db-instance \ --db-instance-identifier test-protected-db \ --skip-final-snapshot

import boto3 import time # Initialize RDS client rds_client = boto3.client('rds') # Create a test RDS instance try: db_identifier = 'test-protected-db-' + str(int(time.time())) rds_client.create_db_instance( DBInstanceIdentifier=db_identifier, AllocatedStorage=20, DBInstanceClass='db.t3.micro', Engine='mysql', MasterUsername='admin', MasterUserPassword='Password123!' ) print(f"Created test RDS instance: {db_identifier}") print("Waiting for instance to become available (this may take several minutes)...") # Note: In a real test, you'd use a waiter here, but for brevity we'll just wait a bit time.sleep(30) # Try to delete the RDS instance (this should be denied) try: rds_client.delete_db_instance( DBInstanceIdentifier=db_identifier, SkipFinalSnapshot=True ) print("WARNING: Successfully deleted RDS instance - SCP is NOT restricting as expected") except Exception as e: print(f"Expected error for deleting RDS instance if SCP is working: {e}") # Note: If the SCP actually works, you'll need to remove it to clean up this test instance print(f"Note: If the SCP worked, you'll need to detach it to delete the test instance {db_identifier}") except Exception as e: print(f"Error creating test RDS instance: {e}")