DeleteGlobalCluster
AWS
DeleteGlobalCluster
Event
Deletes an Aurora global database cluster that spans multiple AWS regions.
Security Context
- Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.
Log Source
CloudTrail
Sample Event
Adversarial. Draco deletes the THUNDERBIRD multi-region Aurora global cluster (after his prior RemoveFromGlobalCluster + DeleteDBCluster calls on the regional clusters). T1485 — final stage of cross-region database wipe.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T19:02:11Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:22:55Z", "eventSource": "rds.amazonaws.com", "eventName": "DeleteGlobalCluster", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "globalClusterIdentifier": "thunderbird-global-aurora" }, "responseElements": { "globalCluster": { "globalClusterIdentifier": "thunderbird-global-aurora", "globalClusterResourceId": "cluster-THUNDERB1RDGL0BAL000001", "globalClusterArn": "arn:aws:rds::555123456789:global-cluster:thunderbird-global-aurora", "status": "deleting", "engine": "aurora-mysql", "engineVersion": "8.0.mysql_aurora.3.05.2", "storageEncrypted": true, "deletionProtection": false, "globalClusterMembers": [] } }, "requestID": "90000000-0000-4000-8000-000011100100", "eventID": "90000000-0000-4000-8000-000011100101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...