Skip to main content
rightsizing · aws

RDS Excessive Backup Retention

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

Backup retention beyond 7 days on dev/test RDS databases exceeds the non-production ceiling. ZopNight classifies them but permanently abstains from quantifying today: the backup_chargeable_bytes signal sums gross snapshot storage without netting AWS's free allowance, so any dollar figure would overstate the real RDS:ChargedBackupUsage charge.

Signal and threshold

How ZopNight evaluates RDS Excessive Backup Retention.
Field Value
Rule IDsRC-032
Categoryrightsizing
Severitylow
Metricnone — pure configuration read
Sourcerds_backup_retention.go

Reading retention days from discoverer metadata

  • resource.Name: dev/test pattern (with prod env-tag as an authoritative veto via isProdEnvTag)
  • Metadata[“backup_retention_days”] (JSON int, discoverer-stamped from BackupRetentionPeriod, not a Tag, since the prior retentionDaysFromTags read was a dead contract); must be > maxNonProdRetentionDays
  • PricingAware: per-resource monthly cost
  • Metadata[“backup_chargeable_bytes”] (stringified int64): the producer discoverer/internal/provider/aws/rds_backup_enrichment.go does stamp this key on live data (wired as aws-rds-backup, enrichment flag defaults ON), so it is not a producer gap. It is, however, not billing-truth: it sums the gross AllocatedStorage of every DescribeDBSnapshots result (automated and manual) with no netting of AWS’s free backup allowance, which covers 100% of total provisioned DB storage in the region and no automated/manual split, so it can overstate the true RDS:ChargedBackupUsage charge by a large, effectively unbounded factor that the cost cap does not meaningfully bound.

The non-production retention ceiling

Terminal window
maxNonProdRetentionDays=7

Why this rule never puts a dollar figure on it

backupSavings currently always returns “not quantified”. The rule permanently abstains on dollar quantification (never fires a recommendation) rather than price off the unreliable backup_chargeable_bytes signal described above, so it never fabricates a cost-driven saving. The rds-snapshot SKU rate plumbing (SetSKURates/TargetSKUCandidates) is retained un-read so a future rebase onto the real billed RDS:ChargedBackupUsage CUR/billing line item (netted against the region free allowance, automated-snapshots-only) only needs to change backupSavings’ body. Classification (dev/test name, prod-env veto, retention threshold, pricing presence) still runs but cannot currently produce a recommendation.

Trimming retention back to 7 days

  1. Evaluate if retention > 7 days is needed for this non-production database
  2. Go to RDS Console → Modify → Backup retention period
  3. Set to 7 days for non-production workloads
  4. Consider using manual snapshots for longer retention needs

No metrics, only the backup storage SKU rate

None (SKURatesAware: rds-snapshot backup-storage SKU rate)

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·