AWS RDS Instance or Cluster Deleted

Description

Detects RDS database instance or cluster deletion. Deletions that skip final snapshots result in permanent data loss and may indicate ransomware, insider threats, or compromised credentials being used to destroy data.

Query · python

from panther_aws_helpers import aws_rds_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    deletion_events = ["DeleteDBInstance", "DeleteDBCluster"]
    if event.get("eventName") not in deletion_events:
        return False
    return event.deep_get("errorCode") is None


def title(event):
    event_name = event.get("eventName", "Unknown")
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="<UNKNOWN>"
    )
    skip_snapshot = event.deep_get("requestParameters", "skipFinalSnapshot", default=False)
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    snapshot_warning = " [NO FINAL SNAPSHOT]" if skip_snapshot else ""
    if event_name == "DeleteDBInstance":
        return f"RDS Instance Deleted: [{db_identifier}] by [{user}]{snapshot_warning}"
    return f"RDS Cluster Deleted: [{db_identifier}] by [{user}]{snapshot_warning}"


def dedup(event):
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="unknown"
    )
    account_id = event.deep_get("recipientAccountId", default="unknown")
    region = event.get("awsRegion", "unknown")
    return f"{account_id}:{region}:{db_identifier}"


def alert_context(event):
    context = aws_rds_context(event)
    context["skip_final_snapshot"] = event.deep_get(
        "requestParameters", "skipFinalSnapshot", default=False
    )
    context["final_snapshot_identifier"] = event.deep_get(
        "requestParameters", "finalDBSnapshotIdentifier"
    ) or event.deep_get("requestParameters", "finalDBClusterSnapshotIdentifier", default="N/A")
    context["delete_automated_backups"] = event.deep_get(
        "requestParameters", "deleteAutomatedBackups", default="N/A"
    )
    return context


def severity(event):
    skip_snapshot = event.deep_get("requestParameters", "skipFinalSnapshot", default=False)
    delete_backups = event.deep_get("requestParameters", "deleteAutomatedBackups", default=False)
    if skip_snapshot or delete_backups:
        return "CRITICAL"
    return "HIGH"

Analyst notes

Find all RDS API calls by the user ARN in the 48 hours before the alert to identify precursor activities
Check if this user has deleted databases in the past 90 days to determine if this is unusual behavior
Look for deletion protection changes from this user in the 24 hours before the deletion

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-04-20
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_rds_instance_deletion.yml
Type: rule
Version: 1
References: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html
Data sources: AWS.CloudTrail

ATT&CK

TA0040 T1485 T1531