DeleteGlobalCluster
DeleteGlobalCluster
Event
Deletes the Aurora global database after its primary and secondary clusters have already been detached or destroyed. It does not itself delete all regional database clusters. Detached standalone clusters may still retain their data.
Security Context
The event may be the final step of an unauthorized destructive sequence (contextual T1485) or normal global-topology cleanup. Empty membership is not proof that the regional data was destroyed. Distinguish global-object removal from earlier member operations.
Log Source
AWS CloudTrail management event with eventSource: rds.amazonaws.com and eventName: DeleteGlobalCluster. Check errors and subsequent resource/task state; request acceptance is not always completion. A null response alone does not establish success or failure.
Key Fields
| Field | Investigation value |
|---|---|
requestParameters.globalClusterIdentifier | Global database identifier; reconstruct prior membership. |
responseElements.globalCluster.globalClusterMembers | Membership in the response, not evidence of how former members were removed. |
userIdentity, sourceIPAddress, userAgent | Caller and supporting context; not proof of malicious intent. |
eventTime, awsRegion, recipientAccountId, eventID, requestID | Timeline, scope, and correlation identifiers. |
What to Investigate
- Confirm the operation outcome and compare caller, target, and timing with the approved workflow. Review failed attempts separately.
- Recover prior members and verify each detachment or deletion and the approved topology change.
- Inspect surviving regional clusters and their data/backup state. Do not infer cross-Region erasure from an empty list.
- Correlate DeleteDBCluster and availability evidence to establish actual impact.
Sample Event
Synthetic scenario. Draco deletes thunderbird-global-aurora with no members in the illustrative response. Regional clusters may have been detached rather than destroyed; the sample cannot decide which.
Exact CloudTrail field presence, response wrappers, and timestamp serialization remain unverified against captured records. Resource identifiers are fictional; neither names nor this illustrative record establish data contents or downstream actions.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "ASIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T19:02:11Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:22:55Z", "eventSource": "rds.amazonaws.com", "eventName": "DeleteGlobalCluster", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "globalClusterIdentifier": "thunderbird-global-aurora" }, "responseElements": { "globalCluster": { "globalClusterIdentifier": "thunderbird-global-aurora", "globalClusterResourceId": "cluster-THUNDERB1RDGL0BAL000001", "globalClusterArn": "arn:aws:rds::555123456789:global-cluster:thunderbird-global-aurora", "status": "deleting", "engine": "aurora-mysql", "engineVersion": "8.0.mysql_aurora.3.05.2", "storageEncrypted": true, "deletionProtection": false, "globalClusterMembers": [] } }, "requestID": "90000000-0000-4000-8000-000011100100", "eventID": "90000000-0000-4000-8000-000011100101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com" }}Sources
MITRE ATT&CK Mapping
Tactics: Impact
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...