Skip to content

DeleteGlobalCluster

AWS

DeleteGlobalCluster

service: AWS - RDS
tactics:
techniques:

Event

Deletes an Aurora global database cluster that spans multiple AWS regions.

Security Context

  • Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

CloudTrail

Sample Event

Adversarial. Draco deletes the THUNDERBIRD multi-region Aurora global cluster (after his prior RemoveFromGlobalCluster + DeleteDBCluster calls on the regional clusters). T1485 — final stage of cross-region database wipe.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "AKIADRAC0MALF0YEXAMP5",
"userName": "draco",
"sessionContext": {
"attributes": {
"creationDate": "2026-04-15T19:02:11Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-04-15T21:22:55Z",
"eventSource": "rds.amazonaws.com",
"eventName": "DeleteGlobalCluster",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"globalClusterIdentifier": "thunderbird-global-aurora"
},
"responseElements": {
"globalCluster": {
"globalClusterIdentifier": "thunderbird-global-aurora",
"globalClusterResourceId": "cluster-THUNDERB1RDGL0BAL000001",
"globalClusterArn": "arn:aws:rds::555123456789:global-cluster:thunderbird-global-aurora",
"status": "deleting",
"engine": "aurora-mysql",
"engineVersion": "8.0.mysql_aurora.3.05.2",
"storageEncrypted": true,
"deletionProtection": false,
"globalClusterMembers": []
}
},
"requestID": "90000000-0000-4000-8000-000011100100",
"eventID": "90000000-0000-4000-8000-000011100101",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "rds.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Impact

Techniques:
  • T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...