Skip to content

DeleteDBInstance

AWS

DeleteDBInstance

service: AWS - RDS
tactics:
techniques:

Event

Permanently deletes an RDS database instance, with an option to take a final snapshot before deletion.

Security Context

  • Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

CloudTrail

Sample Event

Adversarial. Draco deletes the standalone OCCAMY metadata RDS instance with skipFinalSnapshot: true and deleteAutomatedBackups: true. Both flags set together is a recovery-denial signal — the operator is consciously skipping the safety nets. T1485.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "AKIADRAC0MALF0YEXAMP5",
"userName": "draco",
"sessionContext": {
"attributes": {
"creationDate": "2026-04-15T19:02:11Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-04-15T21:14:05Z",
"eventSource": "rds.amazonaws.com",
"eventName": "DeleteDBInstance",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"dBInstanceIdentifier": "occamy-metadata-prod",
"skipFinalSnapshot": true,
"deleteAutomatedBackups": true
},
"responseElements": {
"dBInstanceIdentifier": "occamy-metadata-prod",
"dBInstanceClass": "db.r6g.large",
"engine": "postgres",
"dBInstanceStatus": "deleting",
"masterUsername": "occamy_admin",
"engineVersion": "15.5",
"dBInstanceArn": "arn:aws:rds:us-east-1:555123456789:db:occamy-metadata-prod",
"dbiResourceId": "db-OCCAMYMETADATA0PROD01",
"deletionProtection": false,
"storageEncrypted": true,
"kmsKeyId": "arn:aws:kms:us-east-1:555123456789:key/60000000-0000-4000-8000-000000000001"
},
"requestID": "90000000-0000-4000-8000-000011011000",
"eventID": "90000000-0000-4000-8000-000011011001",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "rds.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Impact

Techniques:
  • T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...