Question

A CloudOps engineer must ensure that all RDS database instances across a single account have deletion protection enabled. The security team wants a fully managed, low-maintenance solution that continuously evaluates existing and newly created RDS instances and records compliance status, without the engineer writing or maintaining any evaluation logic. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable the AWS Config managed rule rds-instance-deletion-protection-enabled and view compliance results in the AWS Config dashboard.

Answer

Create an AWS Config custom rule backed by a Lambda function that describes each RDS instance and evaluates the DeletionProtection attribute.

Answer

Create an EventBridge rule that triggers a Lambda function on RDS API calls to check deletion protection and publish findings to Security Hub.

Answer

Use AWS CloudTrail with Athena queries scheduled daily to identify RDS instances that were created without deletion protection.