AWS RDS Abandoned Manual Snapshot Accumulation Detector
Identify orphaned manual Amazon RDS database snapshots retained long after the originating DB instance or cluster was decommissioned and deleted.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- Manual RDS snapshots (SnapshotType == 'manual') retained for > 90 days where the originating DB instance has been deleted.
- Accumulated chains of manual snapshots that bypass automatic RDS backup retention windows.
- Orphaned staging, test, and dev snapshots retaining gigabytes of cold storage with zero read access.
What It Cannot Establish Alone
- Whether a specific manual snapshot is a legally mandated statutory financial backup (e.g. fiscal year-end books) required by tax or compliance authorities.
- Whether the snapshot represents the sole surviving archive of customer data prior to an application migration.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::RDS::DBSnapshotVerification Protocol: Tested against synthetic manual DB snapshot chains older than 90 days with absent source instance identifiers.
Validation Context: Validated in development and testing accounts where developers captured pre-deletion snapshots that accumulated unmonitored for over 18 months.
3. Reproducible AWS CLI Verification Recipe
List manual RDS snapshots in ap-south-1 created over 90 days ago.
# List manual RDS snapshots created > 90 days ago in ap-south-1
aws rds describe-db-snapshots \
--region ap-south-1 \
--snapshot-type manual \
--query "DBSnapshots[?AllocatedStorage > `50`].{SnapshotId:DBSnapshotIdentifier,DBInstance:DBInstanceIdentifier,SizeGB:AllocatedStorage,Created:SnapshotCreateTime,Engine:Engine}" \
--output table---------------------------------------------------------------------------------------------------------------------------------
| DescribeDBSnapshots |
+---------------------------+------------------------+-----------+-----------------------------------+--------------------------+
| Created | DBInstance | Engine | SizeGB | SnapshotId |
+---------------------------+------------------------+-----------+-----------------------------------+--------------------------+
| 2025-11-14T08:22:10.000Z | old-staging-orders-db | postgres | 500 | pre-delete-backup-orders |
+---------------------------+------------------------+-----------+-----------------------------------+--------------------------+💡 Snapshot 'pre-delete-backup-orders' has been retained for 11 months following the deletion of instance 'old-staging-orders-db', accumulating $0.105/GB-mo backup storage fees.
4. Transparent Economic Model
- Illustrative scenario based on 2,048 GB (2 TB) of orphaned manual RDS snapshots retained past operational utility.
- Backup storage exceeds the 100% database storage free allocation at static ₹84.00/USD conversion.
- Once the DB instance is deleted, ALL associated manual snapshots are billed at standard backup storage rates ($0.105/GB-mo in Mumbai).
- Actual savings depend on total allocated snapshot gigabytes and compliance data retention requirements.
- Automated snapshots deleted upon instance termination are excluded (only manual snapshots persist).
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Statutory Year-End Audit Archives: Snapshots preserved specifically to satisfy regulatory audit requirements without running an active database.
- Golden Image Baseline: Snapshots utilized as base templates to spin up ephemeral developer environments on-demand.
Blast Radius & Remediation Risks
- Irreversible Deletion: Deleting an RDS snapshot is permanent. There is no native recycle bin or undo capability for RDS snapshots unless AWS Backup Vault Lock is enabled.
- Mitigation: Export snapshot data to an Amazon S3 Glacier bucket or copy to an archive account before issuing deletion.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Export Snapshot to Amazon S3 (Optional Long-Term Archive)
If compliance mandates archival, export snapshot to S3 Parquet at 80% lower cost.
aws rds start-export-task --region ap-south-1 --export-task-identifier export-orders-2025 --source-arn arn:aws:rds:ap-south-1:123456789012:snapshot:pre-delete-backup-orders --s3-bucket-name company-cold-archives --iam-role-arn arn:aws:iam::123456789012:role/rds-s3-export-role --kms-key-id arn:aws:kms:ap-south-1:123456789012:key/archive-keyDelete the Orphaned Manual Snapshot
Delete the manual snapshot to eliminate recurring storage fees.
aws rds delete-db-snapshot --region ap-south-1 --db-snapshot-identifier pre-delete-backup-ordersForensic Rollback Procedure
RDS snapshot deletion is permanent and cannot be reversed natively. If exported to S3, data can be queried via Athena or restored via custom loader scripts.
🔒 ArthaOps Assurance: ArthaOps requires two-person verification and confirmation of source instance deletion before proposing RDS snapshot deletion.
RDS does not provide a native Recycle Bin for DB snapshots. Once deleted via the API, the snapshot data cannot be recovered by AWS Support.
How This Appears in the ArthaOps Control Plane
Manual 500 GB PostgreSQL snapshot retained for 334 days after source database was permanently deleted.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.