DeleteDBInstance
AWS
DeleteDBInstance
Event
Permanently deletes an RDS database instance, with an option to take a final snapshot before deletion.
Security Context
- Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.
Log Source
CloudTrail
Sample Event
Adversarial. Draco deletes the standalone OCCAMY metadata RDS instance with skipFinalSnapshot: true and deleteAutomatedBackups: true. Both flags set together is a recovery-denial signal — the operator is consciously skipping the safety nets. T1485.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T19:02:11Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:14:05Z", "eventSource": "rds.amazonaws.com", "eventName": "DeleteDBInstance", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "dBInstanceIdentifier": "occamy-metadata-prod", "skipFinalSnapshot": true, "deleteAutomatedBackups": true }, "responseElements": { "dBInstanceIdentifier": "occamy-metadata-prod", "dBInstanceClass": "db.r6g.large", "engine": "postgres", "dBInstanceStatus": "deleting", "masterUsername": "occamy_admin", "engineVersion": "15.5", "dBInstanceArn": "arn:aws:rds:us-east-1:555123456789:db:occamy-metadata-prod", "dbiResourceId": "db-OCCAMYMETADATA0PROD01", "deletionProtection": false, "storageEncrypted": true, "kmsKeyId": "arn:aws:kms:us-east-1:555123456789:key/60000000-0000-4000-8000-000000000001" }, "requestID": "90000000-0000-4000-8000-000011011000", "eventID": "90000000-0000-4000-8000-000011011001", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...