RDS DB clusters should be configured to copy tags to snapshots
Severity: Low
Resource Types: AWS::RDS::DBCluster
Description
This control checks whether RDS DB clusters are configured to copy all tags to snapshots when the snapshots are created.
Identification and inventory of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your RDS DB clusters so that you can assess their security posture and take action on potential areas of weakness. Snapshots should be tagged in the same way as their parent RDS database clusters. Enabling this setting ensures that snapshots inherit the tags of their parent database clusters.
Remediation
To enable automatic tag copying to snapshots for a DB cluster
- Open the Amazon RDS console.
- Choose
Databases
. - Select the DB cluster to modify.
- Choose
Modify
. - Under
Backup
, selectCopy tags to snapshots
. - Choose
Continue
. - Under
Scheduling of modifications
, choose when to apply modifications. You can choose eitherApply during the next scheduled maintenance window
orApply immediately
.