Databases in RDS is suddenly deleted (empty)

Question

My databases in RDS was working normally but suddenly empty. The database was still there but all data inside is deleted.

I check the DB instance monitoring, event log and CloudTrail but still cannot find anything abnormal.
Could you suggest what is the best practise and activity to be performed for do some investigation?

Here is sone instance configurations
* Instance class: db.t2.micro (Free Tier Plan)
* vCPU: 1
* RAM: 1 GB
* Multi-AZ: No
* Encryption: Not enabled
* Storage type: General Purpose SSD (gp2)
* Storage: 5 GiB
* Storage autoscaling: Disabled

Riku_Kobayashi · Accepted Answer

Hello.  
Does it mean that the RDS instance is still there but all the data inside is gone?  
RDS data is not deleted unless you manipulate it with SQL or other means.  
If the query log is enabled, you will be able to see Delete and Drop operations from there.  
https://repost.aws/knowledge-center/rds-postgresql-query-logging

RDS can also be restored from snapshots if RDS snapshots are still available.  
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html

derekyonghai · Answer

Have you check the CloudWatch metrics to see what happend to your RDS?

Afshaar · Answer

you can check it by using logs , like general logs, error logs, audit logs. make sure to click on parameter group then your can see your rds parameter group and then search general,error, audit logs and change value to 1 and restart the DB. now go to RDS logs not cloudwatch logs and you can see it the logs. Now monitor and make sure to take backup according to your requirement.

Fong Soon Fan · Answer

It happened to me as well, on RDS Postgres Database instance.

You can set the following to prevent the problem:
i)  Inbound rules for security group shouldn't open to anywhere, but to VPC or specific security group access,
ii) Use strong password for default user, don't use the default password

Databases in RDS is suddenly deleted (empty)

Relevant content